Brotli Decoder Flaw Extends Beyond Node.js to PHP, Bun and Python
A critical vulnerability in Google’s Brotli decoder affects more than Node.js, with potentially vulnerable implementations also found in Bun, Python, PHP and other software, according to reporting published on October 26. CVE-2026-111497 allows unauthenticated attackers to send specially prepared Brotli data over the network and potentially read sensitive memory, cause denial of service or execute arbitrary code.
The flaw is a buffer-overflow problem in Brotli versions 1.0.3 through 1.2.0 on all platforms. Google rates it 9.2, or Critical, under CVSS 4.0. Software that links to Brotli through C bindings can inherit the problem, including Java JNI wrappers, PHP and Ruby extensions, and Go cgo bindings. Aikido’s analysis also identified C++ software, Bun and Envoy as affected.
Google fixed the decoder in Brotli 1.0.10, 1.1.1 and 1.2.1. The corresponding fixed Node.js releases are 26.12.1, 24.22.1 and 22.23.4. Python users should update the Brotli package to 1.2.1 or brotlicffi to 1.2.1.0. Administrators using applications that bundle Brotli should check whether those bundles contain one of the corrected versions.
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 because the packages included an affected Brotli version. The replacement builds are 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, and include Brotli 1.2.1. The exposure depends on automatic decompression through cURL: cURL leaves that setting disabled by default, but applications and HTTP libraries can enable it. Guzzle enables it by default in the cited releases when using cURL.
Until updates are installed, OpenAI advises disabling automatic Brotli decompression in HTTP clients. In PHP, that means not setting CURLOPT_ENCODING. Applications using Guzzle can set decode_content to false, which disables automatic decoding altogether, including for gzip responses. Removing br from the Accept-Encoding header alone is not sufficient because a server may still send Brotli data.
Apache and Nginx are not considered exposed in their standard configurations because they do not decode Brotli there. Proof-of-concept exploits are publicly available in some cases, and Imperva researchers achieved code execution against an unchanged Node.js build after several attempts. However, the cited reports say that exploitation in the wild is not known, and CISA recorded no exploitation in its October 23 assessment.