Critical Brotli flaw CVE-2026-111497: patch Node.js, Bun, Envoy, Istio

A critical flaw in the Brotli compression library, CVE-2026-111497, is fixed in new releases of Brotli, Node.js, Bun, Envoy and Istio. Update to a fixed version below, and check what you run with each project's version command. No exploitation in the wild has been reported.

Each version comes from that project's own release notes or advisory. Envoy's versions come from its security advisory, GHSA-3wvj-j6qm-62mr; its release notes do not mention Brotli.

#What changed?

Google, which maintains Brotli, published Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, 2026 (UTC), each with the note "CVE-2026-111497: out-of-bounds write permits remote code execution." The CVE record, issued by Google, says the flaw in "Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream."

Google scores it CVSS 4.0 9.2 Critical as the CVE issuer. Node.js rates it "(high)" on its own scale. NVD lists the record as "Awaiting Analysis" and has no score of its own.

The underlying fix was committed to Brotli's source on February 27, 2026. OpenAI said on X that "it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."

#Who found it?

The CVE record credits OpenAI Codex Security, and Envoy's advisory credits "OpenAI Security Research." OpenAI said on X that "During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli," referring to an exercise in which it says teams of agents searched its research environments. That account is OpenAI's; the official credits name OpenAI teams, not agents.

#Who is affected and when?

Any software that decodes Brotli data with an affected copy of the library. According to Node.js, "This vulnerability affects Node.js 26.x, 24.x, and 22.x." Aikido Security, an independent security company, reported that "Every supported release line had the flaw before the October 21 update, and Bun had it too until version 1.4.4."

Aikido explains why many apps reach the decoder without asking for it: "fetch() decompresses Brotli responses automatically, so a server an attacker controls or has compromised can reach your app through its response." That matters for AI agents and tools that fetch untrusted URLs. A Bun issue report says the same of Bun's fetch().

• Bun: Bun 1.4.4 updates its bundled Brotli to 1.2.1, which contains the fix. Bun's release post lists Brotli among its security fixes without naming the CVE.
• Envoy: affected are "Envoy deployments that have Brotli decompressor configured," per Envoy.
• Istio: Istio's bulletin says "Users who enable Brotli decompression, for example with an EnvoyFilter, should upgrade." Istio 1.29 reached end of life on October 15, 2026, and 1.29.9 is its final release.
• Python: the GitHub Advisory Database lists the PyPI brotli and brotlicffi packages as affected, fixed in brotli 1.2.1 and brotlicffi 1.2.1.0.
• Linux distributions: distro brotli packages use their own version numbers, so check your distribution's advisory, such as the Debian tracker or Ubuntu's CVE page. Aikido notes that Node.js from a distribution package "may use the system Brotli library instead of the copy Node.js bundles."

On exploitation, CISA's assessment on the CVE record lists exploitation as none, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog. Aikido reported that "No exploitation in the wild had been reported as of October 22, 2026."

#What should you do?

Check your versions. Compare the output with the table above.

• Node.js: node -v
• Bun: bun --version
• Envoy: envoy --version
• Istio: istioctl version
• Brotli command-line tool: brotli --version (this shows the tool's version only, not the library other software loads)
• Docker images, per Aikido: docker run --rm <image> node --version

1. Do not rely on process.versions.brotli in Node.js. Node.js fixed the flaw by applying Brotli's fix to its bundled copy without changing the bundled version number. Patched Node.js 22.23.4 still reports Brotli 1.1.0, and patched 24.22.1 still reports 1.2.0, the same as the unpatched 24.22.0. Use node -v.
2. Update. Move to a fixed version from the table. On Istio 1.29, plan a move to 1.30 or later. On Envoy 1.36, move to a supported branch. For Python, update brotli or brotlicffi. For system packages, follow your distribution's advisory.
3. If you cannot patch. Patch the Planet, an OpenAI initiative, advises: "If you cannot patch immediately, disable Brotli decompression of untrusted data until the update is deployed." It adds that "Using Brotli only to compress outgoing data does not by itself establish exposure to this decoder flaw." Aikido reported that "The Node.js advisory offers no workaround for the Brotli flaw."

#How does it compare?

OpenAI says it disclosed this flaw to Brotli and downstream projects such as Node.js. Patch the Planet, the OpenAI initiative behind our coverage of the two critical PHP flaws, has a page on it. The LiteLLM 1.107.0 compromise and the OpenCode Console breach are unrelated incidents. Both also called for quick action from developers.

#What is still unclear?

• NVD score. NVD has not analysed the record or published its own score.
• Distribution fixes. Ubuntu lists its releases as "Needs evaluation," and Debian still lists some branches as vulnerable.
• Exploitation. None has been reported in the wild in the sources reviewed.