CVE-2026-111497 is a memory-corruption flaw in Google’s Brotli decoder. Imperva researchers showed attacker-supplied code running on an unpatched Node.js build.
That leaves Node.js, Bun, Python packages, and Envoy deployments with a shared decoder problem that each project has to patch on its own. The practical risk appears only when software decodes Brotli data that someone else controls.
Node.js and Google shipped fixes
The flaw was first disclosed on October 21, and Node.js and Google shipped fixes that day. Google rates it 9.2 on the CVSS 4.0 scale, while Node.js calls it high.
The decoder bug can overwrite past the end of a buffer, which can crash a process, leak memory, or run attacker-controlled code. For a user, that means the dangerous path is not ordinary traffic handling but parsing compressed data from an external server or upload.
Python and Envoy exposure paths
In Python, the risk begins as soon as Brotli or brotlicffi is installed, because HTTP clients such as requests, urllib3, httpx, and aiohttp then decode Brotli responses on their own. In Envoy and Istio, the problem appears only when Brotli decompression is enabled.
For Node.js and Bun, built-in fetch() can hit the flaw when it reads a response sent with Content-Encoding: br, and request-body code such as Express 5 and body-parser 2 can reach it while unpacking a Brotli upload. A plain Node.js HTTP server does not decode request bodies on its own.
Node2Shell and the open gap
Imperva’s Red Team, which calls its work Node2Shell, ran attacker-supplied code on Node.js 24.22.0 for Linux on ARM64. The exploit was delivered both as a fetched response and as an Express request body, and it took several tries.
The same result has not been shown on the other affected software, and the exploit has not been released or tested on other builds. CISA’s October 23 assessment recorded exploitation as none and automation as no, while Red Hat said there is no reliable public proof-of-concept for running code.
OpenAI’s Codex Security team reported the flaw, and OpenAI describes it as enabling unauthenticated remote code execution in Brotli. For teams running affected software, the immediate task is to update the decoder copy inside each product, because one fix does not cover the rest.
The unresolved piece is practical reach: which other affected software can be pushed from memory corruption to code execution in real use. Until that is shown, the risk is real, but the demonstrated exploit path remains specific to one unpatched Node.js build.
