Brotli: crafted compressed stream overflows buffer, enables remote code execution

Brotli vulnerability (CVE-2026-111497) — Patch the Planet

CVE-2026-111497 · Updated October 23, 2026

Brotli decoder vulnerability

Crafted Brotli-compressed data can corrupt memory and allow remote code execution in affected software, including Node.js, Bun, and deployments of Envoy Proxy or Istio configured for Brotli decompression.

Fixes are available. Update affected deployments now. If you cannot patch immediately, disable Brotli decompression of untrusted data until the update is deployed.

Start patching

Update to a listed fixed version or a later patched release in the same branch, then restart or redeploy.

Fixed releases · Reviewed October 23, 2026

Who is affected

Any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed. This includes compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files. The bug can cause crashes, disclose memory, or allow code execution.

Check web services, background workers, tools that bundle Node.js or Bun, and deployments of Envoy Proxy or Istio configured to decompress Brotli.

Other software to check

• Embedded runtimes: apps such as Electron-based desktop tools can include multiple Brotli copies. Check both Chromium and Node.js; a fixed browser component does not establish that the embedded Node.js runtime is fixed.
• Native clients and bindings: check the decoder loaded by curl/libcurl, Python and Java bindings, and other native libraries. Bundled wheels and static binaries may need their own update or rebuild.
• File processing: include font decoders and data-file readers that use Brotli. Exposure is not limited to HTTP traffic.

Using Brotli only to compress outgoing data does not by itself establish exposure to this decoder flaw.

Disable Brotli decoding until you can patch

You can keep other compression enabled. Disable Brotli decoding of untrusted data while allowing gzip, deflate, or other supported codecs. Apply this to every decoding path; if your stack cannot block Brotli separately, disable automatic decompression or pause that path until patched.

• Incoming requests: reject requests with Content-Encoding: br before any proxy, middleware, or body parser decompresses them. Cover direct-to-origin and alternate routes.
• Fetched responses: disable automatic Brotli decompression in HTTP clients. Reject Brotli responses before decoding; if your client cannot do this, pause the affected fetch or use a patched client. Removing br from Accept-Encoding alone does not stop a server from sending it.
• In Envoy Proxy and Istio, disable Brotli decompressor filters for both requests and responses. Disabling a filter can pass compressed data onward, so protect downstream decoders too.
• Files and other inputs: pause untrusted Brotli processing until the decoder is patched.

Turning off Brotli response compression on a CDN or web server does not disable request or client-side decompression. Request-size limits and WAF rules alone do not cover every decoding path.

Express: reject Brotli, keep gzip and deflate

Allow only uncompressed, gzip, or deflate request bodies before any parser runs. Keep automatic decompression enabled for those permitted encodings.

Express request encoding guard

Copy

// Register before every body parser or decompression middleware.
app.use((req, res, next) => {
  const encoding = (req.get('Content-Encoding') || 'identity')
    .trim().toLowerCase();

  if (!['identity', 'gzip', 'deflate'].includes(encoding)) {
    return res.status(415).send(
      'Use gzip, deflate, or an uncompressed request body.'
    );
  }
  next();
});

// Keep your existing parser options and register routes afterward.
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

Place this guard before all JSON, form, raw, text, and route-specific parsers. It rejects Brotli, unknown encodings, and stacked encodings such as gzip, br with HTTP 415. A proxy that decodes requests first needs its own mitigation.

If you cannot enforce the guard before decoding, set inflate: false on every existing body parser as a fallback. That rejects all compressed request bodies, including gzip and deflate.

Express body-parser options ↗

Next.js: disable built-in image optimization until Node.js is patched

If you cannot update Node.js immediately, set images.unoptimized globally. This stops the built-in image optimizer from fetching and decoding remote images. Merge this setting into your existing configuration, then rebuild and redeploy:

Next.js image optimization workaround

Copy

// next.config.js: retain your other settings.
module.exports = {
  images: {
    // Retain your existing images settings here.
    unoptimized: true,
  },
};

Images are served directly from their source URLs. Verify that requests to /_next/image no longer run the optimizer. This does not protect other server-side fetches, custom image loaders, or other Brotli decoders.

Next.js unoptimized image option ↗

Disable only the Brotli decompressor in Envoy Proxy and Istio

Remove the HTTP decompressor filter whose decompressor_library uses the Brotli type. Keep separate gzip and zstd decompressor filters. Alternatively, disable both directions in that existing Brotli filter:

Envoy Proxy Brotli decompressor settings

Copy

# Inside the existing Brotli decompressor's typed_config.
# Leave separate gzip / zstd decompressor filters enabled.
request_direction_config:
  common_config:
    enabled:
      default_value: false
response_direction_config:
  common_config:
    enabled:
      default_value: false

Replace the existing direction settings and remove any runtime_key from these two enabled fields; a runtime override can otherwise re-enable Brotli. An omitted direction defaults to enabled.

For Istio: edit the original EnvoyFilter patch that inserts the Brotli filter. Remove that insertion or apply the settings above to it. Do not remove every filter named envoy.filters.http.decompressor; gzip and zstd can share that name.

A disabled or removed filter passes encoded bytes onward. Reject Brotli before any remaining vulnerable application or client decoder. Verify the effective configuration on every affected gateway and sidecar, and test that permitted compression still works.

Envoy Proxy decompressor settings ↗ Envoy Proxy runtime flags ↗ Istio EnvoyFilter reference ↗

Python HTTP client: accept gzip and deflate, reject Brotli

With urllib3, leave the body unread and undecoded until you have checked its encoding. This example allows uncompressed, gzip, and deflate responses, and rejects Brotli even if the server ignores Accept-Encoding.

Python urllib3 response encoding guard

Copy

import urllib3

http = urllib3.PoolManager()
response = http.request(
    "GET", url,
    headers={"Accept-Encoding": "gzip, deflate"},
    preload_content=False,
    decode_content=False,
    redirect=False,
    retries=False,
    timeout=10.0,
)
try:
    encoding = response.headers.get("Content-Encoding", "identity")
    if encoding.strip().lower() not in {"identity", "gzip", "deflate"}:
        raise ValueError("Unsupported response content encoding")
    data = response.read(decode_content=True)
finally:
    response.close()
    response.release_conn()

Keep redirects and retries disabled for this example. If you add th