senn-techsenn-tech
Security
Security and data protection2026-10-26· By Franz Senn

Brotli flaw CVE-2026-111497: Node.js, Python and .NET are affected, what you have to rebuild

On 21 October Node.js and Google released fixes for a bug in the Brotli decoder. It is tracked as CVE-2026-111497, and heise gives a CVSS 4 score of 9.2. Updates for .NET followed on 25 October. The bug is a buffer overflow, and public proof-of-concept code exists. heise and BleepingComputer both report that no attacks in the wild are known so far. The flaw also goes by the names Node2Shell, HTTP2Shell and Broccoli2Shell.

PyPI logo
Python HTTP clients are affected too when they run with a vulnerable Brotli decoder. The fixes have been on PyPI since 23 October. (Quelle: Simple Icons, file pypi.svg (CC0))

This post rests on the reports from heise and BleepingComputer, the advisory from the Node.js project and our own measurements on 26 October. What we measured ourselves is marked as measured. Everything else is what the sources state.

What the bug does

The decoder reports an invalid block switch as a temporary need for more input instead of a permanent format error. The Node.js project describes the result: the streaming decoder keeps appending bytes to an internal eight-byte buffer and writes past its end. That can crash the process, leak memory contents or run code. According to heise, Imperva reached code execution on an unmodified Node.js build, though only after several attempts.

The advisory credits OpenAI Codex Security (Khai Tran) and Sylvie Mayer with finding the bug. Aikido, as relayed by heise, says the fix was in the source code since February but was not treated as a security fix at the time. A release only followed now.

Two routes to a victim

An attacker can send compressed data straight to a server that decodes Brotli. They can also serve a malicious response when an application fetches a URL they control. The second route covers any service that handles webhooks, link previews, imports or fetches made by agents. Blocking only inbound Brotli requests at the proxy closes the first route and leaves the second open (BleepingComputer).

Apache and Nginx do not decode Brotli in their default configuration, so heise rates them as less exposed. That holds for those two only, and only without extra modules.

Affected versions and fixes

From the advisory to a fixed serviceInventoryNode, Python, .NET, Bun,containersRead versioncheck the runtime inside thecontainerUpdatepatched runtime or packageRebuildnew image, restart processVerifynode -v in the runningcontainer
Order follows the recommendations from BleepingComputer and heise. Verifying in the running container is our addition. (Quelle: BleepingComputer, 26 Oct 2026)
  • Brotli (Google): affected 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1.
  • Node.js: fixed in 22.23.4, 24.22.1 and 26.12.1.
  • Python: Brotli 1.2.1 and brotlicffi 1.2.1.0. BleepingComputer lists urllib3[brotli], requests, httpx and aiohttp[speedups] as affected when they run with a vulnerable decoder.
  • .NET: updates since 25 October. BleepingComputer reports that Microsoft warns of privilege escalation on versions that are not updated. Neither source gives version numbers.
  • Bun: affected according to Aikido, and heise names no fix.
  • Bundled copies: software that uses Brotli through C bindings (Java JNI, PHP and Ruby extensions, Go with cgo) often ships the decoder itself.

What we measured on our systems

On 26 October we looked inside the running containers, not at the build files. The two Next.js containers on our development host, one of them serving senn-tech.com, run v24.22.1, the fixed release. The Dockerfile pins the base image to that patch tag and a digest.

There is a trap here: in these fixed containers process.versions.brotli still reports 1.2.0. The library's version string is therefore no test. The Node.js advisory does not say why. We suspect Node patched its own copy without changing the number (inferred). The Node version itself is what counts.

On two of our LiteLLM gateways we checked whether brotli or brotlicffi is installed in the Python environment. Both modules are missing, so the Python route is closed there. An image tag such as weekly-20261026 says nothing about the runtime inside, so read the Node version in the container.

What to do now

  1. List every service that uses Node.js, Python HTTP clients, .NET or Bun, including helper services and CI runners.
  2. Read the version in the running environment: node -v in the container, pip list for Brotli and brotlicffi.
  3. Move the runtime or package to the versions above, restart the process, rebuild the image and roll it out. An updated system library changes nothing about a bundled copy.
  4. If you cannot update at once, disable Brotli in Python applications and block inbound Brotli-compressed requests at the proxy, as BleepingComputer recommends. The Node.js advisory adds that you can avoid passing untrusted Brotli data to node:zlib.

Services that fetch foreign URLs are reachable through the malicious response even when no port points at them from the internet. Patch those first.

Further sources

Questions?
Which versions does CVE-2026-111497 affect?+

The Brotli decoder from Google in versions 1.0.3 through 1.2.0 (heise). It is fixed in 1.0.10, 1.1.1 and 1.2.1. In Node.js the 22, 24 and 26 lines are affected, and the fixed releases are 22.23.4, 24.22.1 and 26.12.1. The Python packages Brotli 1.2.1 and brotlicffi 1.2.1.0 contain the fix. .NET has had updates since 25 October, but none of the sources gives a version number.

Is it enough to update the operating system's Brotli library?+

No, if the software ships its own copy. BleepingComputer writes that updating the system library does not remove the risk in Node.js, because Node bundles the decoder. After updating the runtime, restart the processes and rebuild container images.

Does blocking inbound Brotli requests at the proxy help?+

Only partly. The attack has two routes: a compressed request sent to a server, and a malicious compressed response when your own application fetches a URL an attacker controls. A proxy filter closes only the first. BleepingComputer says so.