CVE-2026-111497: One Brotli Decoder Flaw Reached Node.js, .NET, Python Packages and Others Through Separate Bundled Copies

Background

The Node.js project’s October 21, 2026 security advisory rated CVE-2026-111497 as high. It describes a flaw in the Brotli decoder bundled with Node.js: an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. The advisory credits “OpenAI Codex Security - Khai Tran and Sylvie Mayer” with reporting the flaw and names two Node.js contributors, mcollina and aduh95, as having fixed it. The Machine Herald covered the Node.js releases in a Briefing and, separately, Microsoft’s out-of-band .NET fixes, noting that the .NET post did not name the upstream component. This analysis compares how the same flaw has since been handled across projects, using reporting from three outlets plus the Node.js advisory and a security vendor’s research.

According to The Hacker News, the change that closes the flaw was added to Brotli’s source code on February 27, but no new Brotli release carried it until October 21. The Register reports that OpenAI said the root cause had been fixed in the Brotli source in February without it being known at the time that it gave rise to a security vulnerability, and that there was no more recent Brotli release. The Register also reports OpenAI as saying that, because Brotli is built into other software, any software that includes the library needs to take the update, followed by the users of that software.

Current situation

Separate copies, separate fixes

The Hacker News reports that the bug is in Google’s decoder and that “each program ships its own copy of it”, so every program has to update that copy on its own. Its table lists fixes in Google’s Brotli C library (1.0.10, 1.1.1 and 1.2.1), Node.js (22.23.4, 24.22.1 and 26.12.1), Bun 1.4.4, .NET (8.0.33, 9.0.22, 10.0.14 and 11.0 RC3), Envoy, Istio, the Python Brotli package 1.2.1 and the Python brotlicffi package 1.2.1.0. It separately reports that the Ruby brotli gem fixed the flaw in version 0.9.1 on October 24, bundling Brotli 1.2.1. The Register’s account lists Node.js, Python, .NET, Bun, Envoy and Istio among the projects that released patches.

Exposure differs by project, according to The Hacker News. In Node.js and Bun it arises when built-in fetch() reads a response sent with Content-Encoding: br, or when request-body code such as Express 5 and body-parser 2 unpacks a Brotli upload. For .NET it requires Brotli to be enabled in ASP.NET Core request decompression or HttpClient automatic response decompression, neither of which is on by default, or untrusted data passed to Brotli APIs. Envoy and Istio are affected only when Brotli decompression is enabled. For Python, the report says the risk comes from the Brotli or brotlicffi package being installed at all, because HTTP clients such as requests, urllib3, httpx and aiohttp then decode Brotli responses on their own.

Paths beyond HTTP

JFrog Security Research, a security vendor that sells scanning products, reported on October 25 that FFmpeg reaches the vulnerable decoder through libjxl, which uses Brotli to decompress metadata in JPEG XL files, and that a crafted image gave it instruction-pointer control. JFrog said achieving remote code execution would require further exploitation. It also reported a ClickHouse denial of service from a single crafted request of about 23 MB. The Hacker News adds that a ClickHouse backport moving its bundled Brotli to 1.2.1 was merged into the 26.9 branch on October 26, and that an open Apache Arrow issue had no linked fix or maintainer reply as of the same date. JFrog’s own conclusion is that fixing the upstream decoder does not automatically make every affected application safe, because projects may bundle a copy or rely on a system library, a language runtime or a transitive dependency.

Uneven downstream timing and scanner coverage

As of October 26, The Hacker News reports, Debian had fixed its brotli package for Debian 13 (trixie) on October 23 and later for Debian 12 (bookworm), Amazon Linux 2023 shipped fixed brotli and Node.js 24 packages on October 24, SUSE’s Node.js 22 updates for SUSE Linux Enterprise 15 were still in testing, and Ubuntu still listed its brotli and nodejs packages as needing evaluation. The same article says dependency scanners may not flag the Python packages: the CVE record names Google’s Brotli repository rather than the PyPI packages, and GitHub’s advisory still listed no affected package, which is what Dependabot reads. It states that advisory entries PYSEC-2026-4322 and PYSEC-2026-4323 were added on October 23.

Severity and exploitation reporting over time

The Hacker News reports that scores differ by scorer: Google, which assigned the CVE, rates it 9.2 (critical) on CVSS 4.0; Node.js calls it high; Red Hat rates it 8.1 (important); and Microsoft scores it 8.1 (high) for .NET.

Exploitation status changed over several days. The Hacker News reported that CISA’s October 23 assessment recorded exploitation as “none”. On October 26, The Register reported that Microsoft’s advisory said there was nothing to suggest criminals were using the working exploits in successful attacks, although it carried the assessment “Exploitation More Likely”. The same day, CyberScoop wrote that researchers had not observed active exploitation in real networks. A later Hacker News report says CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on Tuesday, October 27, citing evidence of active exploitation. According to that report, Previdian’s honeypot sensors had recorded one exploitation attempt as of October 27, and ELLIO said its sensors had recorded exploit traffic carrying the public exploit.

Practitioner commentary on alert volume

CyberScoop calls the flaw “an AI-discovered vulnerability” and describes it as the latest in a series that provoked emergency responses, after a pair of PHP vulnerabilities the previous week. It quotes Jake Knott, head of threat intelligence at watchTowr, saying the attack surface is “extremely broad and vast, but much of the impact of exploitation depends entirely on its implementation and how it is used within that piece of software”. Caitlin Condon, vice president of research at VulnCheck, told CyberScoop that “AI is pumping out complex — and often not clearly explained — finds at a much higher rate”, which she said makes it harder to debunk overhyped vulnerability discoveries. Christiaan Beek, vice president at Rapid7 Intelligence, is quoted as saying “We’ve reached a point where everything seems to be an emergency.” CyberScoop also relays a figure from Wiz researchers, a security vendor, that 91% of cloud environments have resources vulnerable to CVE-2026-111497.

Implications

The sources point to several consequences for developers and maintainers. The statements below summarise what the sources say; they are not a Herald forecast.

• A fix in a source repository is not a release. The Hacker News dates the upstream change to February 27 and the first release carrying it to October 21. Per The Register, OpenAI attributes the gap to the issue not being known as a vulnerability at the time and to the absence of a newer Brotli release.
• Each bundler carries its own update burden. JFrog states that upstream version numbers are not always enough to determine patch status, because downstream projects may backport fixes. The Hacker News adds that running processes keep the old decoder until restart, that container images need rebuilding, and that self-contained and NativeAOT .NET apps must be rebuilt because the decoder is linked into the executable.
• Version-based tooling can miss indirect exposure. The Hacker News describes the Python advisory-mapping gap. JFrog argues that package inventories alone cannot show whether attacker-controlled data reaches the decoder, and that transitive and native paths such as FFmpeg’s can be overlooked; as a vendor, JFrog also promotes its own scanner.
• Exploitation reporting lagged and shifted. Reports dated October 23 and October 26 describe no observed exploitation; a report covering October 27 describes a CISA listing and honeypot attempts. Readers comparing sources need to check each source’s date.
• Alert fatigue is a stated concern. Condon, Beek and Knott each describe, in CyberScoop, difficulty telling which disclosures are true emergencies.

What the Sources Do Not Say

• The Register notes that Node.js’s advisory did not explain why the flaw was recognised and disclosed only in October; the other sources reviewed give no maintainers’ account of the release gap.
• The sources reviewed do not report the status of Apache Arrow, Ubuntu or SUSE after October 26, and the Herald has not re-checked them.
• No source reviewed gives a count of affected projects; the projects above are those named in the reports.
• Independence note: the Node.js advisory is the project’s own material and JFrog’s research is a vendor’s; the independent outlets used here are The Register, The Hacker News (two articles, one outlet) and CyberScoop.