One Brotli Bug, Many Victims: Imperva Turns CVE-2026-111497 Into Code Execution on Stock Node.js

A memory-corruption flaw in Google's Brotli decompression code, tracked as CVE-2026-111497, has been shown to allow attacker-supplied code to run on an official, unmodified build of Node.js. Researchers at Imperva published the demonstration, which they call "Node2Shell." It follows the coordinated disclosure on October 21, when Node.js and Google shipped fixes. The flaw was reported by OpenAI's Codex Security team. It is not limited to Node.js: Bun, Python's Brotli packages and Envoy proxies are also affected, and each needs its own patch.

What happened

Brotli is a compression format created by Google and widely used on the web to shrink pages and other traffic. The bug sits in the C code that unpacks, or decodes, a Brotli stream. Many programs ship their own copy of that decoder, so the flaw has spread into language runtimes, proxies and libraries.

The timeline is unusual. The code change that closes the hole was added to Brotli's source on February 27. However, no Brotli release included it until October 21. OpenAI explained that the underlying problem had been fixed months earlier, but nobody then realised it was a security vulnerability, and no newer Brotli release existed to carry the fix.

Node.js credited Khai Tran and Sylvie Mayer of OpenAI's Codex Security for the report. It credited maintainers Matteo Collina and Antoine du Hamel for the fix. Node.js and Google published fixes on October 21, and other vendors have been following one product at a time.

A first public proof of concept, meaning a demonstration that an attack is possible, achieved code execution only on a test build that had been deliberately weakened. On a normal build, its author reported only a crash and a limited read of process memory. Imperva went further. Its Red Team ran attacker-supplied code on the official Node.js 24.22.0 image for Linux on arm64, with no debugger and no custom build. The exploit was not reliable and needed several attempts. It has not been released publicly. When the same crafted data was fed to the patched 24.22.1 release, it was rejected and no code ran.

Who is affected

According to the verified CVE record, the vulnerable code is in Google Brotli versions 1.0.3 through 1.2.0 on all platforms. Software reported as affected includes:

• Node.js 22.x, 24.x and 26.x release lines, which bundle the decoder. End-of-life lines (20.x and older) will not receive a fix.
• Bun, the JavaScript runtime.
• Python's Brotli and brotlicffi packages.
• Envoy and Istio, but only when Brotli decompression is switched on, for example through an Envoy filter.

Being affected depends on whether a program decodes Brotli data that someone else controls. In Node.js and Bun, this happens in two main ways. The first is when the built-in fetch() function reads a response marked Content-Encoding: br. The second is when middleware unpacks a Brotli-compressed upload. Express 5's body parsers, such as express.json(), express.urlencoded(), express.text() and express.raw(), now decode Brotli bodies alongside gzip and deflate. A plain Node.js HTTP server does not decode request bodies by itself. Imperva reproduced code execution through both the upload path and the response path. It tested Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 at fixed versions, not every release in between.

Python carries a less obvious risk. If either Brotli package is simply installed, popular HTTP clients such as requests, urllib3, httpx and aiohttp will decode Brotli responses automatically. An application can therefore be exposed even if its own code never mentions Brotli.

How it works

As a Brotli stream is decoded, it announces the "block types" it will use. Imperva found that crafted input could reach a block change that the stream's own structure should have made impossible. Instead of treating this as an error, the vulnerable decoder assumed it simply needed more input and carried on in a broken internal state.

In a separate test using a memory sanitizer (a tool that catches illegal memory access), continuing from that state wrote data past the end of an intended buffer. This is an out-of-bounds write: data spills into memory it should not touch. The CVE record classifies the weakness as CWE-787 (out-of-bounds write) and CWE-252 (an unchecked return value). Depending on the target, such corruption can crash a program, leak memory contents or, as Imperva showed, lead to code execution.

The fix, taken from upstream Brotli, makes the decoder stop with a format error at that impossible point instead of continuing.

How serious is it?

The ratings differ depending on who is scoring:

• Google, which assigned the CVE, scores it 9.2 (Critical) on CVSS 4.0. This matches the verified CVE data.
• Node.js rates it high.
• Red Hat rates it 8.1, or important. It also says no reliable public proof of concept for code execution exists.

OpenAI describes the bug as enabling unauthenticated remote code execution, meaning an attacker would not need to log in. It lists Node.js, Bun and Envoy as affected.

On real-world abuse, the sources agree. No exploitation in the wild has been reported. The flaw is not in CISA's Known Exploited Vulnerabilities catalogue. CISA's October 23 assessment recorded exploitation as "none" and automation as "no."

The practical caveats matter. Imperva's success covers one build on one architecture, and needed repeated tries. It did not test other architectures or the 22.x and 26.x lines. Code execution has not been demonstrated on Bun, Python or Envoy.

What to do now

For administrators and developers:

• Update Node.js to a patched release on a supported line. For 24.x, the fixed version is 24.22.1. Move anything on 20.x or older to a supported line.
• Update Brotli libraries in the 1.0.3–1.2.0 range. The CVE record names later releases, including 1.0.10 and 1.1.1, as fixed.
• Patch Bun, the Python Brotli/brotlicffi packages and Envoy/Istio as vendor fixes become available.
• Restart services after updating, because a running process keeps the old decoder in memory. Rebuild container images and any artifact that bundles a Node binary, since package inventories can miss these.
• Track operating system packages. Debian fixed brotli for Debian 13 (trixie) on October 23 in version 1.1.0-2+deb13u1. Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending as of October 22.
• Don't rely on dependency scanners alone. The CVE record names Google's repository, not the PyPI packages, so scanners may not flag Python installs yet.
• If you cannot patch immediately, OpenAI and security firm Aikido recommend rejecting inbound requests marked Content-Encoding: br before anything decodes them. They also suggest disabling automatic Brotli decoding in HTTP clients and uninstalling the Python Brotli packages so clients fall back to gzip and deflate.
• Don't count on removing br from your Accept-Encoding header. A server can send Brotli regardless of what the client asks for.
• Treat web application firewalls as partial protection. Imperva and Vercel both added rules for inbound attacks. Vercel noted its rules do not cover "responses your functions fetch from other servers."

For everyday users: this is mainly a server-side and developer problem. Keep any developer tools and runtimes you have installed up to date, and apply system updates when your operating system offers them.

What we still don't know

• Whether code execution is achievable on x86 builds, on Node.js 22.x and 26.x, or on Bun, Python and Envoy.
• The specific fixed version numbers for every Node.js line and for Bun, Envoy and the Python packages. These were not detailed in the reporting reviewed.
• When Amazon Linux and other distributions will ship patched packages.
• How many other programs quietly bundle a vulnerable copy of the Brotli decoder.
• Why the fixed code sat unreleased for nearly eight months without anyone spotting its security impact.

ITVedas analysis: The bigger lesson here is about supply chains rather than one runtime. A fix sat in a shared library for months, and every program that embeds its own copy now has to catch up separately. Teams should inventory where Brotli lives in their stack, especially inside containers and Python environments, rather than assume a single Node.js upgrade closes the issue.