# Brotli Vulnerability CVE-2026-111497: Why It Is Bigger Than Node.js

> Source: <https://explainx.ai/blog/brotli-vulnerability-cve-2026-111497-beyond-nodejs-python-bun-curl-what-to-do-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog>
> Published: 2026-10-24 00:00:00+00:00

**A bug in Brotli, a compression library that sits inside much of the software you use every day, can let an attacker run their own code through specially broken compressed data.** OpenAI announced the flaw on October 24, 2026, saying it found it during a red-teaming exercise. No login is needed. The official name is CVE-2026-111497, and the CVE record rates it 9.2 out of 10 on the CVSS 4.0 scale.

You may have read about it as a Node.js problem. That is only the first layer. [Node.js shipped its fix on October 21](https://explainx.ai/blog/nodejs-security-release-october-2026-brotli-rce-tls-hostname-bypass-emudhra-2026), but the same Brotli code also lives in Bun, Python packages, Envoy, Istio and curl builds that use Brotli. Researchers have started calling the wider problem "HTTP2Shell." This post explains who is affected, what is confirmed and what is not, and what to update. If you want the engineering detail, AgentBeam has a [technical deep dive](https://agentbeam.com/blog/brotli-cve-2026-111497-affected-software-python-bun-envoy-curl-detection?ref=explainx).

## The short version

| Question | Answer | 
|---|---|
| What is it? | A bug in Brotli, the library that unpacks Brotli-compressed data | 
| How bad? | The CVE record gives 9.2 of 10 (CVSS 4.0). Node.js rates it High. An attacker can crash a program or possibly run code | 
| Do attackers need an account? | No. They only need to send you broken compressed data, or answer your request with it | 
| Who is affected? | Programs that bundle Brotli 1.0.3 to 1.2.0 and decode data from outside | 
| Is it being exploited? | No attacks reported as of October 23, 2026, but public test code exists | 
| What fixes it? | Update the program that includes Brotli, then restart it | 
| Does Node.js 20 get a fix? | No. Node.js 20 and older are end of life | 

## What happened, in plain English

Compression makes files smaller so websites load faster. Brotli is one of the most common formats, created at Google, and web servers send it when your browser or tool says it accepts it. To read the data, a program has to unpack it again. That unpacking code is the decoder.

Think of the decoder as a worker who unloads boxes into a fixed-size storage room. The bug lets a carefully made box trick the worker into stacking items past the room's walls and into the next room. In software this is called an out-of-bounds write, and it is a classic way to take over a program: the attacker's data lands where the program's own instructions live.

OpenAI put it this way in its post: "an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as `curl --compressed`) could be taken over by a malicious server."

According to Cycode's analysis, the trick is a data stream that says it has only one kind of block and then switches blocks anyway. The decoder did not reject it and kept going in a broken state. The weakness is tracked as CWE-787, "out-of-bounds write."

## Why a February fix still caused an October emergency

This is the odd part of the story. OpenAI says the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."

Cycode puts the fix commit in the google/brotli repository on February 27, 2026. A developer fixed what looked like a correctness problem. Nobody labeled it a security bug, so nobody released a new version or told the programs that copy Brotli inside themselves.

That matters because Brotli is "built into other software." OpenAI explains it simply: "any software which includes this library needs to take the update too, followed by the users of that software." So the fix has to travel down a chain: Brotli, then Node.js or Bun or a Python package, then your app, then your server. Every link has to move.

The dates, from the sources we checked:

| Date | What happened | 
|---|---|
| February 27, 2026 | Fix committed to the Brotli source, with no release and no security notice | 
| October 21 | Node.js releases 22.23.4, 24.22.1 and 26.12.1. Brotli 1.0.10, 1.1.1 and 1.2.1 appear | 
| October 22 | CVE published. Bun 1.4.4 ships with the fixed Brotli. A team shows code execution on Node.js 24.22.0 | 
| October 24 | OpenAI explains the find and points to its Patch the Planet page | 

## Am I affected? A table by who you are

Exposure needs two things at once: a program with a vulnerable Brotli, and a way for an attacker's data to reach the decoder. Here is how that looks for different readers.

| You are... | Risk | What to do | 
|---|---|---|
| A learner running Node.js on your laptop for tutorials | Low | Update when convenient with `nvm install 22` or similar | 
| A developer with a Node.js API (Express 5, Koa, Fastify) | High if it accepts compressed request bodies | Update Node.js now and restart. See the [Node.js update guide](https://explainx.ai/blog/nodejs-security-release-october-2026-brotli-rce-tls-hostname-bypass-emudhra-2026) | 
| A developer who fetches web pages or APIs from code (Node.js `fetch()` , Python`requests` ,`httpx` ,`aiohttp` , Scrapy) | Medium to high | Update Node.js and the Python `Brotli` or`brotlicffi` packages. Pay most attention to code that fetches URLs you do not control | 
| A Bun user | Medium | Update to Bun 1.4.4. Rebuild anything made with `bun build --compile` | 
| Someone who runs Envoy or Istio | Medium to high | Move to a fixed release (see the table below) | 
| A person who uses curl in the terminal | Low to medium | Update curl or your system Brotli package. Avoid `--compressed` against servers you do not trust until you do | 
| A site owner on WordPress or PHP | Not this bug | Brotli is not the PHP problem. But [PHP2Shell](https://explainx.ai/blog/php2shell-cve-2026-109618-109619-what-happened-what-to-do-now-2026) needs your attention the same week | 

## Which versions fix it

These are the fixed versions named in the sources we read. Always confirm on the vendor page for the version you actually run.

| Software | Fixed in | 
|---|---|
| Google Brotli library | 1.0.10, 1.1.1 or 1.2.1 | 
| Node.js | 22.23.4, 24.22.1, 26.12.1 | 
| Bun | 1.4.4 | 
| Python `Brotli` | 1.2.1 | 
| Python `brotlicffi` | 1.2.1.0 | 
| Envoy | 1.40.0, 1.39.3, 1.38.6, 1.37.8 | 
| Istio | 1.29.9, 1.30.6, 1.31.2 | 
| curl / libcurl | Depends on the Brotli it loads: use 1.2.1, a patched older release, or your vendor's package | 

Two gotchas deserve a warning.

**Linux distributions often patch without changing the version number.** Debian, Ubuntu and Red Hat sometimes fix a bug and keep the old number, a practice called backporting. A version check alone can mislead you. Read your distribution's security notice for `brotli` instead.

**Python scanners may stay quiet.** Aikido reports that, as of October 23, pip-audit, Dependabot and Safety did not flag the vulnerable Python versions. A clean scan does not prove you are safe. Check by hand with `pip show Brotli brotlicffi` in each environment and each container image.

Python deserves one more note. Your own code does not have to import Brotli to be exposed. HTTP libraries such as `urllib3`, which `requests` uses, load Brotli automatically when it is installed. So an app can use it without you ever typing the word.

## What is confirmed, what is claimed

Security news gets noisy fast. Here is how we sort it.

**Confirmed by multiple sources:**

- The bug is an out-of-bounds write in the Brotli decoder, in versions 1.0.3 through 1.2.0.
- Node.js, Bun and Brotli have shipped fixes.
- The Brotli fix was committed in February and not treated as a security matter until now.
- Public proof-of-concept code exists, and Aikido reports code execution on the official Node.js 24.22.0 Linux arm64 image. It says this did not work on every attempt, and that 24.22.1 rejects the same input.

**Not confirmed:**

- Attacks in the wild. As of October 23, none were reported and the bug was not on the CISA Known Exploited Vulnerabilities list.
- Large package counts. Numbers about hundreds of packages across a dozen ecosystems are circulating on social media, and we could not find a published list behind them. Treat them as unverified.
- Full code execution in every setting. Some public test code only crashes the program, and at least one analysis argues the realistic impact is a denial of service. A crash is already bad for a service that must stay up.

Severity labels also differ. Node.js rates the bug High. The CVE record scores it 9.2 under CVSS 4.0. Both can be true: scoring systems measure different things.

## Why OpenAI's role matters

OpenAI says the bug turned up in a red-teaming exercise, and that it has "removed live internet access for all frontier models during training" and built an offline world for them. The Brotli find follows [Greg Brockman's claim that OpenAI models found PHP2Shell and a Node.js bug](https://explainx.ai/blog/openai-brockman-php2shell-patch-the-planet-ai-found-bugs-remote-patching-2026), and OpenAI's Patch the Planet effort is the thread that ties them together.

Reactions on X split into two camps. Some readers called the pace of disclosures a flood that defenders cannot answer in time. One user wrote that a bug "fixed in February and nobody cut a release" says it all. Others pointed out that a bug found by a defender is better than one found by an attacker. We think both points hold. AI tools find old bugs faster, and the software chain that delivers fixes was built for a slower world.

The practical lesson for builders is simple. Patching is now a weekly routine, not a yearly chore. The [October 2026 attacks tracker](https://explainx.ai/blog/october-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026) lists how many incidents landed in one month, and [PHP2Shell](https://explainx.ai/blog/php2shell-cve-2026-109618-109619-what-happened-what-to-do-now-2026), Node.js and [eMudhra](https://explainx.ai/blog/emudhra-ca-keys-compromised-eight-intermediates-number-4-what-to-do-2026) all landed in the same week.

## What to do right now

Work down this list in order. Most people finish in under an hour.

1. **Find what you run.** Run`node -v` and`bun --version` . In each Python environment, run`pip show Brotli brotlicffi` . Check`curl -V` for a`brotli` entry in the features line.
2. **Update.** Install the fixed versions from the table above. For Node.js,`nvm install 22` gets you the latest 22.x.
3. **Restart and rebuild.** A running program keeps the old code in memory. Restart services and rebuild Docker images with the latest base image, for example`docker build --pull` . Standalone programs built with`bun build --compile` carry their own Brotli and must be rebuilt.
4. **Check the running copy.** Run`node -v` or`pip show` inside the live container, not just on your laptop. A moving tag such as`node:24` does not tell you which version you actually got.
5. **If you cannot patch today, shrink the exposure.** Reject requests with`Content-Encoding: br` at your proxy or load balancer, or turn off body decompression in your web framework. Brandefense notes this also rejects gzip bodies, so test your clients first. These steps do not protect code that fetches Brotli responses from other servers.
6. **Move off end-of-life Node.js.** Node.js 20, 25 and older get no fix. Plan the move to 22 or 24.
7. **Run programs with few permissions.** A stolen program should find as little as possible: no admin rights, no long-lived keys in its environment.

If your team builds with AI agents, treat this as an agent problem as well. A coding agent or browsing agent that fetches pages is a client that reads data from servers it does not control, which is the exact path the bug needs. [AgentBeam](https://agentbeam.com/?ref=explainx), the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions, and it is one way to limit the damage if a tool is taken over.

## Glossary

- **Brotli:** a compression format and library created at Google, widely used on the web.
- **Decoder:** the part of a program that unpacks compressed data.
- **Out-of-bounds write:** writing data past the end of the space reserved for it. It can crash a program or let an attacker plant code.
- **CVE:** a public ID for a security bug, such as CVE-2026-111497.
- **CVSS:** a 0 to 10 score for how serious a bug is. Higher is worse.
- **Backport:** a fix added to an older version without changing its version number.
- **Bundled library:** code copied inside a program, so updating the original does not update the copy.
- **Red-teaming:** testing a system by trying to break it, as an attacker would.

## What people are asking

### Is "Node2Shell" just a Node.js bug?

No. Semgrep's researchers call the nickname somewhat misleading, because the flaw sits in Brotli, not in Node.js alone. Node.js was the first big name to patch, which is why the label stuck.

### Does my browser need an update?

The reports we read focus on Node.js, Bun, Python packages, Envoy, Istio and curl. Browsers carry their own Brotli code, and we found no browser advisory in our sources. Keep your browser on automatic updates, as always.

### Do Nginx and Apache have the problem?

Aikido says Apache's standard `mod_brotli` does not decode Brotli and Nginx does not decode it by default. Both mostly compress outgoing pages. If you added a Brotli decoding module, check it separately.

### Why did scanners not warn me?

Many scanners match package versions against a database, and the Python entries had not reached some of them by October 23. Check by hand, then re-scan in a few days.

### Should I worry about being hacked today?

For most readers the risk is low today and rises with time. Attackers study public test code and fresh patches. The cheap move is to update this week.

## Related reading

**Deep dive on AgentBeam:** [Brotli CVE-2026-111497 affected software, detection and fixes](https://agentbeam.com/blog/brotli-cve-2026-111497-affected-software-python-bun-envoy-curl-detection?ref=explainx)

**Primary sources:** [Patch the Planet: Brotli](https://patchtheplanet.org/brotli?ref=explainx) · [Node.js October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases?ref=explainx) · [Cycode analysis](https://cycode.com/blog/node2shell-cve-2026-111497/?ref=explainx) · [Aikido on Python and HTTP libraries](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497?ref=explainx) · [Brandefense fixed-version check](https://brandefense.io/blog/node2shell-nodejs-brotli-rce-cve-2026-111497/?ref=explainx) · [Qualys](https://blog.qualys.com/product-tech/2026/10/23/node-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-before-attackers-do?ref=explainx)

*Versions and exploitation status are accurate as of October 24, 2026. This story is moving fast, so check the vendor pages above before you act.*