Brotli flaw CVE-2026-111497 reaches beyond Node.js
The “Node2Shell” Brotli decoder bug also affects Python packages and other products that process attacker-controlled Brotli data over HTTP. The article reports an out-of-bounds write in Brotli versions through 1.2.0, with possible memory disclosure, crashes, or code execution; affected paths include inbound compressed requests and outbound responses from untrusted servers.
Fixed releases are available for several projects, including Brotli 1.2.1, Python Brotli 1.2.1 / brotlicffi 1.2.1.0, Node.js, Bun, Envoy, and Istio. Aikido notes that dependency scanners may not yet map the CVE to the Python packages, so teams should inspect resolved dependencies and rebuild affected deployments. The linked HN page exposed no readable comments when checked, so I’m not attributing reactions to its discussion.