Sites and apps on Node.js 22, 24 and 26 that unpack Brotli data they did not make themselves.
Brotli decoder flaw
Compressed data built the wrong way can overwrite memory in an app or proxy that unpacks it, which can crash the app, leak memory or run an attacker’s code.
If your site or app runs on Node.js, Bun or Envoy and unpacks compressed data from outside, it could crash or be taken over until it is updated.
Node.js rates it high. Bun before 1.4.4 and Envoy proxies set up to unpack Brotli are hit by the same flaw.
Update Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, or Envoy to 1.40.0, 1.39.3, 1.38.6, 1.37.8 or 1.36.12.
The Node.js Project has not published anything on exploitation.
Bun says nothing turns Brotli off process-wide. Until you update, pass decompress: false to fetch and keep untrusted data away from the Brotli calls in node:zlib and DecompressionStream.
Ask us at jkca.studio: tell us what your site runs on and we’ll say whether this flaw reaches it.
Sources
- CVE Program: CVE-2026-111497, Out-of-Bounds Write in Google Brotli Decoder (fixed in Brotli 1.0.10, 1.1.1, 1.2.1) October 22, 2026
- The Bun Project: GHSA-663w-cv8g-jj2p, Bundled brotli decoder has an out-of-bounds write October 23, 2026
- The Envoy Project: GHSA-3wvj-j6qm-62mr, Out-of-Bounds Write in Brotli Decompressor October 23, 2026
- The Node.js Project: Wednesday, October 21, 2026 Security Releases October 21, 2026
- CISA: Known Exploited Vulnerabilities catalog, version 2026.10.21 (not listed) October 21, 2026