Google's Brotli flaw could also hit your Python applications

The fix had existed since February. It sat in the source code of Brotli, the compression format created by Google and used everywhere on the web, without having been identified at the time as a security fix. No published release included it. According to security firm Aikido, it is the upstream fix 0ed4268.

On October 21, Node.js released security updates fixing ten vulnerabilities, including this one, tracked as CVE-2026-111497. It is an out-of-bounds write in the Brotli decoder: booby-trapped compressed data could let an unauthenticated attacker corrupt memory and execute code. According to Aikido, the CVE record gives it a score of 9.2 out of 10 (CVSS v4). It was discovered by Khai Tran and Sylvie Mayer of OpenAI's Codex Security team. Since then, the list of affected software has grown, because the flaw lies in Brotli itself and not in Node.js.

Your Python application may be affected without your knowing it

The Python packages Brotli and brotlicffi were fixed on October 22. According to Aikido, the flaw then affects urllib3, and therefore the requests library, as soon as either of these two packages is installed, as well as httpx with its brotli option, aiohttp and Scrapy. “Your code does not need to import either package,” Aikido says: it is enough for them to be present in the environment.

Two attack paths are described. In one, a malicious server returns a Brotli-compressed response to a request from your application (a webhook, a link preview). In the other, your framework decompresses the body of an incoming request sent with the Content-Encoding: br header. Aikido adds that it is not enough to remove Brotli from the Accept-Encoding header: a server can still send it anyway.

No attacks reported, but a successful demonstration

No real-world exploitation has been reported so far. According to Wiz, however, Ron Masas of Imperva's offensive team has demonstrated exploitation on unpatched Node.js environments. Wiz also claims, based on its own data, that 91% of the cloud environments it observes contain vulnerable resources. To help with inventory, Trail of Bits has published a tool that detects Brotli usage in code, according to the Risky Bulletin newsletter.

The versions to install

Here, the main difficulty is finding Brotli: the library is often hidden in an indirect dependency. Here are the fixed versions published by Wiz and Aikido:

• Node.js: 22.23.4, 24.22.1 or 26.12.1. End-of-life branches must move to a maintained version;
• Python: Brotli 1.2.1 and brotlicffi 1.2.1.0 (Brotli is affected from 1.0.3 to 1.2.0);
• Google's Brotli library: 1.0.10, 1.1.1 or 1.2.1 depending on the branch;
• Bun: 1.4.4;
• Envoy proxy: 1.37.8, 1.38.6, 1.39.3 or 1.40.0;
• Istio: 1.29.9, 1.30.6 or 1.31.2;
• Go library andybalholm/brotli: v1.2.7.

Wiz recommends starting with Internet-facing services, rebuilding container images and restarting processes so that the new version is actually loaded. Also remember to regenerate dependency lock files. If the update has to wait, disable Brotli decompression for untrusted data or reject Brotli-encoded requests. This is only a stopgap.

The list is probably not final. Copies of Brotli are embedded in many other pieces of software, and Risky Bulletin expects more vendor patches in the coming months.