Critical flaw in Google's Brotli library forces Node.js and Python security patches

The Node.js project pushed out an emergency security release this week to close a critical hole in Brotli, the data-compression library Google built in 2013 that now ships inside browsers, web servers, content-delivery networks and a large share of the software that moves data over the internet. The flaw, tracked as CVE-2026-111497, lets an attacker who controls a compressed data stream corrupt a program's memory, with the potential to run arbitrary code on the machine decompressing it.

Node.js, the JavaScript runtime that underpins huge portions of the modern web's back-end infrastructure, shipped the fix on October 21 in versions 22.23.4, 24.22.1 and 26.12.1, bundled with nine other vulnerability fixes. Separately, the Brotli project itself, maintained on GitHub by Google, issued corrected releases of the underlying library: versions 1.0.10, 1.1.1 and 1.2.1, replacing every version released since 1.0.3.

A buffer that would not stop writing

The vulnerability database maintained by the U.S. National Institute of Standards and Technology describes the defect in blunt terms.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Node.js's own advisory is more specific about the mechanics: the decoder, on encountering an invalid switch between compression "block types" in a data stream, misread that permanent formatting error as a signal that it simply needed more input. It then kept appending incoming bytes to an internal buffer sized for only eight bytes, writing past the end of it. Any application that uses Node's built-in node:zlib module to decompress Brotli data it does not fully trust is exposed. Google, which assigned the CVE, rated the flaw 9.2 out of 10 under the newest CVSS 4.0 scoring system, in the "critical" band; Node.js's own advisory calls it "high," the top rating given to any of the ten bugs patched in Wednesday's release.

A reach well beyond Node.js

Brotli's exposure is unusually broad because so much software bundles its own copy of the compression code rather than calling out to a shared library. Data from the web-technology tracker W3Techs puts Brotli compression in use on roughly 36% of all websites as of this year, a figure that reflects only sites actively serving Brotli-encoded content and not the much larger universe of software that merely links the decoder. Firefox, Chrome, Safari and Edge have supported the format since 2016 and 2017; nginx, Apache, Microsoft IIS and content-delivery networks including Amazon CloudFront and Cloudflare offer it as well.

The vulnerability is not confined to the JavaScript world. The open-source vulnerability database OSV.dev, which Google also maintains, lists the same flaw under two separate identifiers for Python packages, PYSEC-2026-4322 and PYSEC-2026-4323, confirming that Python bindings to the Brotli library inherited the bug as well. Any application, in any language, that links a vulnerable build of the C library between versions 1.0.3 and 1.2.0 needs to be rebuilt against the patched code, whether or not it ever touches Node.js.

One group gets no fix at all: users still running Node.js 20 or earlier, which reached its end of life earlier this year. Node's security team does not patch end-of-life release lines, leaving organizations still on those versions to either upgrade to a supported line or apply the Brotli fix themselves outside of Node's own release process.

Found by an AI security tool

Node.js credited the discovery to "OpenAI Codex Security," the automated code-auditing tool OpenAI built out of its earlier Aardvark research project, naming researchers Khai Tran and Sylvie Mayer in its thank-you line; the fix itself came from longtime Node.js contributors Matteo Collina and Antoine du Hamel. It is the latest example of an AI-assisted code-scanning tool surfacing a serious, long-dormant bug in widely used open-source infrastructure, a pattern that has recurred through 2026 as developers of large language models test them against software that has gone largely unaudited for years. Independent security trackers flagged the Node.js release the same day it shipped, noting it carried an unusually large batch of fixes for a single Node security release.

Brotli has had security trouble before. A separate buffer overflow, CVE-2020-8927, forced a fix in version 1.0.8 after researchers found that decompressing data chunks larger than two gigabytes through the library's "one-shot" interface could overrun memory. That bug predates the current one by six years and affects an entirely different code path, underscoring how long unpatched edge cases can sit inside compression code that handles untrusted, attacker-shaped input by design.

What comes next

For most organizations, the fix is straightforward: update to the patched Node.js releases, or to Brotli 1.0.10, 1.1.1 or 1.2.1 directly if an application links the library outside of Node. Package maintainers across the Python ecosystem are expected to follow with updated binary wheels tied to the patched C library. Neither Google nor the Node.js Foundation has reported evidence of the flaw being exploited against real systems before the patch shipped, and no proof-of-concept exploit code has surfaced publicly as of this writing.

The bigger question raised by the disclosure is how many other pieces of software quietly bundle an old copy of Brotli's C source without any mechanism to learn that it needs updating — a problem common to compression, parsing and image-decoding libraries that get vendored directly into other projects' codebases rather than tracked as a managed dependency. Security researchers say that audit, more than any single patch, is the slower-moving task the disclosure leaves unfinished.