A memory-corruption bug inside the Brotli compression library — used almost everywhere to shrink web traffic before it's sent over the wire — turns out to reach much further than first reported. Node.js disclosed and patched it on 21 October as CVE-2026-111497, rated HIGH. In the two weeks since, researchers have confirmed the same flaw also affects Python's Brotli and brotlicffi packages, the Bun runtime, curl, and the Envoy and Istio proxies many companies run in front of their own applications — because they all bundle the same underlying Brotli decoder.
The bug itself is simple to describe: when the decoder receives a malformed compressed stream, it's supposed to reject it as invalid. Instead, a coding error causes it to treat the bad data as "need more input" and keep writing bytes past the end of a small internal buffer. An attacker who can get a target application to decompress Brotli data they control — for example, a server auto-decompressing an incoming request body, or a client auto-decompressing an HTTP response — can use that overflow to crash the process, leak memory contents, or in a worst case run their own code on the machine. Security researchers at Imperva built a working exploit (nicknamed "Node2Shell") against an unmodified, official Node.js build within days of the disclosure, triggering it through both fetch() and a standard Express 5 web server. As of this week, no vendor has reported the flaw being exploited outside research labs.
What this means for your business
If your website, app, or API runs on Node.js, this needs attention this week regardless of whether your code touches Brotli directly — the risky path is often automatic, through fetch() calls or a web framework's built-in request decompression. The fix is to update to Node.js 22.23.4, 24.22.1, or 26.12.1 or later. If your team is still running an end-of-life Node.js version (20, 18, or earlier), there is no patch coming for it at all, which is itself a reason to plan an upgrade rather than staying put.
The same question applies more broadly than most businesses will expect: ask whoever maintains your stack whether it touches Python (via the brotli or brotlicffi packages, or libraries like requests, httpx, or urllib3 that can pull them in), the Bun runtime, or a reverse proxy/service mesh such as Envoy or Istio sitting in front of your servers. Each has its own fixed version released over the past two weeks. If you use a managed hosting platform or a maintenance plan with a development partner, the right move is simply to ask them to confirm, in writing, that patched versions are in place across your stack — not to assume routine updates already covered it, since this spans several unrelated ecosystems at once.