Brotli decoder flaw enables RCE in Node.js, Bun and Python

· Cybersecurity

Researchers at Imperva demonstrated "Node2Shell," a proof of concept that ran attacker-supplied code on the official Node.js 24.22.0 Linux arm64 image with no debugger or custom build, by feeding crafted Brotli-compressed data to the application. The underlying memory-corruption flaw, tracked as CVE-2026-111497, sits in Google's Brotli decoder and affects many programs that unpack Brotli data, including Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. Crafted compressed input can overwrite past the end of a buffer, giving attackers code execution. Because the decoder is embedded in so many widely used runtimes and libraries, defenders face a broad patching surface across servers, proxies and developer tooling.

Why it matters：A vulnerability in a ubiquitous compression library reaches far beyond one project, forcing organizations to audit every runtime and proxy that decompresses Brotli data.

Key points

  • The flaw is tracked as CVE-2026-111497.
  • Bun, Python Brotli, brotlicffi and Envoy are among affected software.
  • Imperva ran code on an unmodified official Node.js build.

Sources (original reporting)

More stories from this day