The Brotli Bug Gets Around: Python, Bun and Envoy Now Need Checks

A flaw first publicized in Node.js also affects Brotli decoding across Python packages, Bun and Envoy, widening the software developers must check, according to security advisories and Aikido. ^{[1][2][3][4][5]}

Aikido's October 24 update calls the wider risk "HTTP2Shell". It is the same vulnerability, CVE-2026-111497, reaching more applications through shared compression code. Software that unpacks malicious Brotli data with an affected decoder could crash, disclose memory or potentially let an attacker execute code. ^[1][2]

Brotli makes data smaller for transmission, and a decoder unpacks it at the other end. The vulnerable component can sit several layers below an application, inside a runtime, an optional Python package or a proxy. Exposure depends on whether that decoder is present and whether untrusted data can reach it. ^[1][2][4]

No real-world exploitation has been established by the project advisories or Aikido's findings. The broader product inventory remains developing, and Aikido's warnings about components including Istio and curl/libcurl go beyond the project advisories detailed here. ^[1][2][3][4]

For developers, the immediate job is to find the decoder that is actually running. Updating a top-level application will not necessarily replace a vulnerable copy bundled further down its dependency chain. Aikido recommends checking indirect dependencies and rebuilding applications and containers where they include affected code. ^[1]

One decoder, several routes in

The bug is an out-of-bounds write. Malformed compressed input can make the decoder write past an internal memory buffer, according to Node.js. That turns an operation intended to unpack data into one that can corrupt memory. Node.js says an application must decompress attacker-supplied data for the vulnerability to be triggered. ^[2]

The GitHub advisory identifies affected Google Brotli releases across versions 1.0.3 through 1.2.0, with fixed releases on different branches numbered 1.0.10, 1.1.1 and 1.2.1. It rates the vulnerability Critical, with a CVSS v4 score of 9.2. CVSS is a standard severity scale from zero to 10, so 9.2 puts the flaw near the top and makes patching a priority for exposed systems. Node.js rates it High. ^[2][3]

Those ratings describe the potential severity. The practical question for each application is how compressed data gets to the decoder.

In Python, the GitHub advisory identifies the PyPI packages Brotli and brotlicffi as affected. Aikido says HTTP clients including Requests, HTTPX and aiohttp can load those packages when they are installed, potentially exposing the vulnerable decoder during ordinary HTTP use. ^[1][3]

An application therefore need not explicitly call a Brotli function to warrant inspection. According to Aikido, installing a package that enables Brotli support can make decoding available through the HTTP client the application already uses. The dependency list and the path taken by incoming data both matter. ^[1]

Bun's issue tracker records three affected routes: fetch responses labelled with the HTTP header Content-Encoding: br, the Node-compatible node:zlib interface, and DecompressionStream("brotli"). The header tells software that the response body is Brotli-compressed. The issue was closed after the fix was incorporated. ^[5]

Envoy, a proxy used to handle traffic between services, has a configuration-dependent exposure. Its advisory says affected versions are vulnerable when Brotli decompression is configured. Running Envoy alone does not establish that the vulnerable operation is enabled. ^[4]

The releases to check

Node.js published its security release on October 21, 2026, identifying its 26.x, 24.x and 22.x lines as affected. Aikido lists the corresponding fixed releases as 26.12.1, 24.22.1 and 22.23.4. ^[1][2]

For Bun, Aikido lists version 1.4.4 as fixed. The project's issue tracker separately confirms that its decoder needed the patch and that the fix was completed. ^[1][5]

Envoy's October 23 advisory names affected versions 1.39.2, 1.38.5, 1.37.7 and 1.36.11. It lists fixed versions 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, giving operators patch options across several release lines. ^[4]

Aikido also identifies Istio, a traffic-management layer for networks of services known as service meshes, and curl/libcurl, a common command-line tool and library for fetching web data, as components requiring attention. It recommends examining operating-system packages, bundled libraries and other HTTP servers, proxies, gateways and clients. Those broader findings should prompt an inventory, rather than an assumption that every installation is exploitable. ^[1]

There is a useful counterexample in Apache. Aikido says the standard mod_brotli module, Apache's Brotli module, does not decode Brotli by default. That limits the relevance of this decoder flaw to its default behaviour, but does not clear every Apache configuration or related component. ^[1]

The shared name "Brotli" is therefore only the start of the check. Operators need to identify the version, whether the software performs decompression and whether data from outside their trust boundary can reach that operation.

A patch must reach the running service

The public advisory sequence moved quickly: Node.js on October 21, GitHub's Python advisory on October 22 and Envoy on October 23. Node.js credited OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting the flaw. ^[2][3][4]

The underlying history may be longer. According to Aikido, OpenAI found the flaw in February and the code was fixed then, but it was not recognized as a security vulnerability and no fixed release appeared until October. That discovery account is Aikido's. ^[1]

By its October 23 update, Aikido said patches were available for Brotli, Python, C++, Node.js, Bun and Envoy. Its guidance extends beyond downloading an update: rebuild bundled applications and containers, restart workloads where needed and verify that running services use fixed components. ^[1]

Where a fix is unavailable, Aikido recommends disabling or rejecting Brotli decoding before vulnerable software processes the data. ^[1]