Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
On October 21, 2026, Node.js issued three emergency security patches. The culprit was not a bug in the JavaScript runtime itself, but a vulnerability in Google's Brotli compression decoder, CVE-2026-111497, carrying a CVSS 4.0 score of 9.2. The most unsettling detail: the fix had existed in the Brotli source since February 27, 2024, yet it was never flagged as a security correction nor shipped in any official release. That silence left eight months of exposure across software bundling Google's C library.
- CVE-2026-111497 is an out-of-bounds write in the decoder's c/dec/decode.c file, rated CVSS 4.0 9.2 (Critical) by Google as CNA; affects versions 1.0.3 through 1.2.0.
- The fix was committed upstream on February 27, 2024, but no release included it until October 21, 2026, leaving Node.js, Bun, Python, Envoy, Istio, and other downstream consumers vulnerable.
- Imperva demonstrated RCE against the official Node.js 24.22.0 build for Linux ARM64, though the exploit is unreliable and has not been publicly replicated.
- As of October 23, 2026, CISA assesses exploitation as "none" and automation as "no"; no in-the-wild attacks are documented.
The Mechanism: When the Decoder Accepts Malformed Input
Per the official CVE record, the vulnerability is an out-of-bounds write in the Brotli decoder's c/dec/decode.c file. The decoder mishandles specially crafted compressed data during block-processing operations, treating an impossible block transition as a request for additional input. This behavior allows an unauthenticated remote attacker to corrupt adjacent memory, leak sensitive data, cause denial of service, or potentially execute arbitrary code via a crafted Brotli stream.
Exploitation requires the application to decode attacker-controlled Brotli data. According to The Hacker News, citing OpenAI Codex Security, an unpatched server accepting compressed input can be taken over by a malicious client, and an unpatched client accepting compressed input can be taken over by a malicious server.
"an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as 'curl --compressed') could be taken over by a malicious server" — OpenAI Codex Security, cited by The Hacker News
The Affected Ecosystem: Beyond Node.js
Brotli's bundled nature amplifies the attack surface. Per verified technical sources, Bun is affected through version 1.4.3, patched in 1.4.4. The Python Brotli and brotlicffi packages on PyPI, through versions 1.2.0 and 1.2.0.x respectively, embed the vulnerable decoder; fixes are 1.2.1 for Brotli and 1.2.1.0 for brotlicffi.
In service meshes, Envoy Proxy is vulnerable in versions 1.36.11, 1.37.7, 1.38.5, and 1.39.2, but only when the Brotli decompressor is explicitly configured. Istio follows the same logic: versions 1.29.0–1.29.8, 1.30.0–1.30.5, and 1.31.0–1.31.1 are at risk, with fixes in 1.29.9, 1.30.6, and 1.31.2. The SBOM generation tool cdxgen has also released updates for standalone binaries and container images in versions 13.4.0 and 12.8.8.
The discrepancy between the February 2024 source correction and the absence of official releases until October 2026 represents the core systemic failure. The fix was not recognized as a security patch at the time, and no mechanism propagated the correction through the supply chain as a priority update.
The Limits of the RCE Demonstration
Imperva's security team, led by Ron Masas, validated concrete exploitability against a specific target. According to The Hacker News and Cyber Kendra, both citing Imperva, the demonstration achieved code execution on the official Node.js 24.22.0 build for Linux ARM64, leveraging both the fetch() path and the Express body-parser path. The exploit requires multiple attempts to align memory layout and, per the sources, does not work reliably.
The proof-of-concept has not been released publicly and has not been independently replicated by other teams. No equivalent demonstration exists for Bun, Python, Envoy, or Istio: for these, the CVE record lists RCE as a potential impact, but no public proof of remote execution exists.
CISA classified the exploitation status as "none" and automation as "no" as of October 23, 2026. No documented in-the-wild attacks exist at time of writing. The patch status for some Linux distributions, including Amazon Linux 2023, remained pending as of October 22.
Exposure Numbers: Vendor Estimates on Specific Samples
Cloud security vendors have provided quantitative estimates of the vulnerable surface, to be treated as proprietary metrics not independently verifiable. Qualys estimates roughly 9 in 10 Node.js installations are unpatched or on unsupported release lines, based on anonymized telemetry. Wiz Research estimates 91% of monitored cloud environments have resources vulnerable to CVE-2026-111497, and 82% have publicly exposed Node.js instances.
Qualys further specifies that, of total detected Node.js installations, 1.7 million are on End-of-Life versions and 1.3 million are on supported but unpatched lines. These figures refer to installations, not strictly internet-exposed servers.
In Python, the vulnerability is particularly insidious because it does not require an explicit Brotli module import: per The Hacker News, the mere presence of the PyPI packages triggers automatic decoding in HTTP clients such as requests, urllib3, httpx, and aiohttp when the server responds with Content-Encoding: br.
What to Do Now
- Upgrade Node.js runtimes to versions 22.23.4, 24.22.1, or 26.12.1, released October 21, 2026; a runtime upgrade is required—updating application npm dependencies is insufficient.
- For Python stacks, check for PyPI packages Brotli ≤1.2.0 or brotlicffi ≤1.2.0.x and upgrade to 1.2.1 and 1.2.1.0 respectively; containers and serverless images require a full rebuild and restart.
- In Envoy and Istio deployments, verify whether the Brotli decompressor is configured and apply patches for the versions listed; where inactive, the vulnerability is not exploitable.
- For Bun, upgrade to version 1.4.4 or later, which includes Brotli 1.2.1.
- Dependency scanners may miss Python PyPI packages because the CVE record names the Google repository, not PyPI; manual verification is recommended.
Why This Matters
CVE-2026-111497 illustrates a breakdown in the disclosure and distribution process for security fixes. A technically correct fix, committed in February 2024, remained invisible for eight months because it was not labeled a security patch. No downstream received an automatic alert; every project had to independently discover the commit's relevance.
The separation between source correction and official release created a massive exposure window on a component that, due to its role in transparent compression, is included without dedicated security auditing. The result: millions of installations—per vendor estimates on specific samples—remained vulnerable with no way for administrators or developers to know.
The operational lesson is clear: compression and parsing libraries, precisely because of their operational invisibility, require explicit tracking of security corrections regardless of initial labeling. Until that gap is closed, similar vulnerabilities will continue to lie dormant in code for months, invisible to scanners and standard procedures.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.