CVE-2026-111497 is a memory-corruption flaw in Google’s Brotli decoder, affecting projects including Node.js, Bun, Envoy and Python Brotli packages.

Imperva demonstrated code execution on an unpatched Node.js build; similar execution has not been shown on the other affected software.

The root cause was fixed in source code months before a release carried the fix.

The issue concerns the core code of Brotli, a program used everywhere on the internet to compress files and data so they can be transmitted faster. Because the tool is integrated into many different applications, each program is affected separately and needs its own update.

Which programs are affected?

The list of affected programs includes Node.js, Bun, the Envoy and Istio servers, Python language packages such as Brotli and brotlicffi, and the cdxgen tool.

Security experts have been able to show that an unpatched version of Node.js can execute code using specially crafted data.…