Brotli decoder flaw CVE-2026-111497 exposes Node.js and Python apps to remote code execution

What happened

A flaw in Google's reference C implementation of the Brotli compression format, tracked as CVE-2026-111497, allows a maliciously crafted compressed stream to overwrite memory inside the decoder. According to the advisory published at broccoli2shell.com, the corruption can lead to a memory leak or code execution, and the blast radius is unusually wide: the bug is not limited to code that explicitly decompresses files, because many HTTP clients inflate Brotli-compressed responses on their own. Any server an application fetches from can deliver the payload.

How the flaw works

Brotli streams are divided into blocks, and the decoder switches between block types as it reads them. Before the fix, DecodeBlockTypeAndLength() in c/dec/decode.c returned a plain boolean, so callers could not distinguish a malformed stream from one that simply needed more input, and on the fast path the return value was ignored altogether. A crafted stream can request a block switch that can never legitimately occur; the decoder treated that as a request for additional data and kept appending attacker-controlled bytes to an internal eight-byte buffer, writing past its end and corrupting nearby decoder state. The upstream repair, anchored by google/brotli commit 0ed4268 along with three companion commits, turns the condition into a hard format error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (−17). The issue is classified as CWE-252 (unchecked return value) combined with CWE-787 (out-of-bounds write).

Who is exposed

The advisory groups exposure into three patterns:

• Automatic decompression of HTTP responses. Node.js's built-in fetch() decodes Content-Encoding: br responses by itself, and Python's urllib3 (and therefore requests), aiohttp and httpx do the same whenever a Brotli package is installed — even if the application never imports it. Scrapy and other crawlers can pull the dependency in as well. Webhooks, link previews and import-from-URL features are all candidate entry points.
• Decompression of request bodies. Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli request bodies in parsers such as raw() and json(). The advisory stresses that neither project contains the bug — they are merely paths to it, so upgrading them fixes nothing.
• Direct calls to the decoder, including zlib.brotliDecompress*(), createBrotliDecompress() and brotli.decompress() on archives, caches or queue messages.

Node.js bundles its own copy of Brotli, so the system libbrotli is irrelevant there; patched Node releases are 22.23.4, 24.22.1 and 26.12.1, with older or end-of-life lines affected. You can print the bundled version with node -p "process.versions.brotli". On Python, the PyPI packages Brotli and brotlicffi compile the same C decoder; distribution-supplied bindings are patched through the distro's security updates.

Why scanners may miss it

At disclosure time, pip-audit, Dependabot and Safety did not reliably flag the affected PyPI versions, because the CVE record named Google's upstream repository rather than the Python packages. GitHub's advisory now lists both packages (PYSEC-2026-4322 and PYSEC-2026-4323), but the advisory recommends verifying installations by hand rather than waiting for tooling.

The long tail of bundled copies

Anything shipping or linking Brotli 1.0.3 through 1.2.0 may be affected. The disclosure includes an audit of vendored copies on GitHub, last rechecked on 25 October 2026. Still unfixed a day later were the .NET runtime (exposing BrotliDecoder, BrotliStream and HttpClient auto-decompression, with Microsoft confirming work on a response), DuckDB and Apache Arrow's bundled build via Brotli-compressed Parquet files, v8-jsi, 7-Zip-zstd, p7zip, EDK II's compressed firmware sections, and the Makefile build of woff2. Ruby's brotli gem, PHP's brotli extension and UEFITool shipped fixed releases on 24 October, while ClickHouse, NanaZip, GraalJS, YDB and libjxl have the fix merged on main but, in several cases, not yet in a tagged release. Node.js, Bun, Chromium, Firefox, brotlicffi and others were already patched before the audit. Decoders rewritten in other languages fare better: the Java, JavaScript and C# ports cannot reach the bug, the Go port carried the same logic error but could only crash, and Rust's brotli-decompressor returns an error. Code execution is only possible in the C decoder.

Why it matters

This is a memory-corruption bug reachable over ordinary HTTP with no unusual prerequisites: whichever server a client fetches from controls the decompressed bytes. The advisory's practical guidance is to update Node.js to a patched release, move any Brotli dependency to 1.0.10, 1.1.1 or 1.2.1 (or cherry-pick commit 0ed4268), and hunt down vendored copies that dependency scanners routinely overlook. For maintainers of projects that bundle the C decoder, the presence of the new BLOCK_SWITCH error code is the marker that a copy is fixed.