The Brotli decoder flaw behind a Node.js code execution bug also affects Bun, .NET and Python
A bug in Google's Brotli decoder that corrupts memory (CVE-2026-111497) was disclosed on October 21 alongside fixes from Node.js and Google. Over the following days it emerged that Bun, .NET, Python packages, Envoy and other software carrying the same code are affected too. No attacks in the wild were reported, but each product has to update its own copy.
Disclosed on October 21, with the impact widening product by product
Node.js shipped security releases on October 21, 2026 (22.23.4, 24.22.1 and 26.12.1) that close a write bug in its Brotli decoder, and it lists CVE-2026-111497 as high severity. The same day Google published Brotli 1.0.10, 1.1.1 and 1.2.1; the security section of the 1.2.1 release notes describes the bug as an "out-of-bounds write permits remote code execution". The report came from Khai Tran and Sylvie Mayer at OpenAI's Codex Security, as credited by Node.js.
The Hacker News, which published on October 24 and updated its story on October 26, describes how the impact has spread since then. Its list of affected software includes Bun, Microsoft's .NET, the Python packages Brotli and brotlicffi, and Envoy deployments where Brotli decompression is configured. Microsoft issued out-of-band .NET updates on October 25, and Cloudflare added two rules to its managed firewall ruleset the same day.
Which software is affected and which versions fix it
According to the Node.js advisory, the decoder mistook an invalid block switch for a sign that more input was coming, not for corrupt data, and kept adding bytes to an internal buffer only eight bytes long. If an attacker can feed Brotli input to an app that unpacks it via node:zlib, process memory can be corrupted, causing a crash, a leak of memory contents or remote code execution; the 22.x, 24.x and 26.x lines are affected. In The Hacker News table, Bun 1.4.3 and earlier is fixed in 1.4.4 and the Python Brotli package 1.2.0 and earlier in 1.2.1. For .NET, patched builds are 8.0.33 (.NET 8), 9.0.22 (.NET 9) and 10.0.14 (.NET 10); .NET 11 gets the fix in RC3, and Microsoft says .NET Framework is not affected. Envoy fixes ship in 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0.
Because every product carries its own copy of the decoder, one update does not cover them all. Exposure depends on how software is used: in Node.js and Bun the flaw is reachable when fetch() reads a response sent with br encoding, or when frameworks like Express 5 and body-parser 2 decode a Brotli-encoded request body, whereas a plain Node.js HTTP server leaves request bodies undecoded by itself. In .NET the risk applies when Brotli has been enabled for ASP.NET Core request decompression or for HttpClient automatic response decompression, or when untrusted data goes to APIs like BrotliStream; those settings are off by default. In Python, simply having the package installed is enough, because HTTP libraries like requests, urllib3, httpx and aiohttp then unpack Brotli replies automatically.
Severity scores differ, no attacks reported, updating is the fix
The score depends on the scorer: Google, the CVE's assigner, gives 9.2 (critical) on CVSS 4.0, Node.js says high, and Red Hat and Microsoft (for .NET) give 8.1. Imperva's Red Team, whose demonstration carries the name Node2Shell, ran code on a stock Node.js 24.22.0 Linux ARM64 build; the exploit has not been released. For .NET, Microsoft lists information disclosure, denial of service and elevation of privilege as possible outcomes, not remote code execution. CISA's October 23 assessment records exploitation as none and automatable as no, and no in-the-wild attacks were reported.
As interim measures, OpenAI and the security firm Aikido, as cited by The Hacker News, recommend rejecting requests carrying Content-Encoding: br before they are parsed, or disabling the automatic Brotli decoding that HTTP clients perform. Removing br from Accept-Encoding does not help on its own, since a server can send Brotli whichever way the client asks. According to The Hacker News, no workaround has been published for Node.js, so updating the runtime is the only route. After an update, a running process keeps the old decoder, so services must be restarted and container images rebuilt; self-contained and NativeAOT .NET apps must be rebuilt too. Cloudflare's two rules only log by default and block nothing. The Brotli rule can also match legitimate Brotli request bodies, and the Next.js rule targets the /_next/image endpoint, where switching to blocking could stop optimized images from loading.
The sources say nothing about Türkiye, so this section is commentary
None of the four sources mentions Türkiye: there is no affected local organization, no figure for servers in Türkiye and no statement from a national authority. This section is therefore not a fact drawn from the sources but UNALSOFT's own commentary.
Our reading: a business that runs a custom panel, API or e-commerce back end on Node.js, Next.js or .NET should know which runtime version it is on. Unlike a WordPress plugin flaw, this one is not closed with a single click in a dashboard; the business needs to ask its developer or hosting provider for the version and confirm that a restart followed the update. The unknowns also need listing: how many sites in Türkiye are affected, which versions local hosting providers run and whether a local authority will comment are not covered in the sources. For another urgent patch story, see our October 21 piece on the PHP release.
UNALSOFT's take
We read this as a software maintenance story. The flaw sits in a library embedded in the runtime, not in a plugin added to the site, so the real question is which version your site runs on. For a project built on a Node.js back end, Next.js or a custom API, updating the runtime, restarting the service and rebuilding the image should be part of post-delivery maintenance. That is why it matters for web design projects that the runtime and version in use are written down at handover and that responsibility for updates is clear. Since the sources contain nothing about Türkiye, this article does not suggest any local legal or compliance conclusion.
Sources
Node.js · GitHub google/brotli releases · Cloudflare Developers changelog · The Hacker News
Which version is your site's back end running?
A short conversation is enough to pin down the runtime you use and who is responsible for keeping it updated.