GoKawiilBrotli decoder flaw CVE-2026-111497 spreads beyond Node.js to Python, C++, bun, Envoy
A critical out-of-bounds write vulnerability in Google's Brotli decompression library, first disclosed in Node.js as CVE-2026-111497 on October 21, has been confirmed to affect Python, C++, bun, Envoy and other HTTP-related software. The bug lets an attacker send crafted Brotli-compressed data to corrupt memory, leak data, crash processes or potentially run arbitrary code; patches exist for some affected projects while others are still pending, and Apache and Nginx are not affected by default since they don't decode Brotli.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Brotli is embedded as a dependency across many languages and HTTP stacks, the vulnerability's reach extends well past any single ecosystem, making it hard for developers to know whether their software is exposed without auditing dependencies directly. OpenAI's disclosure that it found the underlying code issue in February, before its security implications were understood, suggests such flaws can lurk unnoticed for months even after partial fixes land. Until all affected software is patched, organizations may need to disable Brotli decoding as a stopgap, which could affect performance or compatibility.
- CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder (versions 1.0.3-1.2.0) exploitable via crafted compressed data.
- Patches are available for libbrotli, Python, C++, Node.js, bun and Envoy, with more expected; Apache and Nginx aren't affected by default.
- OpenAI says it found the root cause in February 2026 but didn't recognize it as a security vulnerability at the time.
Source: aikido.dev, 2026-10-24
Published there as: “Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.