Fixed versions of Node.js, Bun and Envoy have been released for CVE-2026-111497, a vulnerability in Brotli's decompression process. Brotli is a data compression format, and the problem lies in the "decompression" step that restores compressed data. Processing maliciously crafted compressed data can corrupt memory and, under certain conditions, lead to remote code execution (RCE). The attack entry point is not limited to HTTP requests received from outside: it also extends to responses an application fetches from external servers, so checking only traffic to public-facing servers is not enough. According to Patch the Planet's guidance, updated October 23, mitigation requires checking not only the runtimes in operation but also the distributed applications that embed them and the destinations that proxies forward traffic to.
Invalid input misjudged as "insufficient input," causing writes beyond an 8-byte buffer
According to the Node.js security advisory, the cause was error handling in the streaming decoder, which decompresses data as it is received in pieces. The decoder mistakenly treats an invalid block switch, which should halt processing, as a temporary shortage of input. As a result, it can keep appending data to an 8-byte internal buffer and write past the allocated memory region, an "out-of-bounds write." The issue can cause process crashes and leaks of in-memory information, and may even lead to RCE, the advisory says.
Treating data that should have been rejected as invalid as a state of waiting for more input is what leads to the memory corruption. Importantly, the vulnerability lies not in compression but in the process that decompresses compressed data. An application that merely compresses outgoing data with Brotli is not necessarily affected. What needs to be checked is where, and how, the application decompresses compressed data it receives from outside.
Node.js says the 26, 24 and 22 release lines are affected and rates the severity "High." The discoverers credited are Khai Tran and Sylvie Mayer of OpenAI Codex Security. Brotli itself released version 1.2.1 as a security fix on October 21, 2026, and Node.js released its fixed versions the same day. Fixes are already available; the challenge now is applying them reliably to environments that use the vulnerable implementation.
Not only inbound HTTP requests: outbound fetch is also an attack path
In configurations where an application or middleware decompresses the body of an HTTP request arriving from outside, that request can serve as an entry point for an attack. Decompressing responses an application fetches from external servers can also invoke the same vulnerable code. However, simply exposing an HTTP server does not mean immediate impact. The problem arises when there is a path by which attacker-prepared Brotli-compressed data reaches the vulnerable decoder.
According to Bun's official advisory, fetch, which retrieves external data, automatically decompresses HTTP responses that specify Content-Encoding: br. This header indicates that the response body is compressed in Brotli format. Bun also lists node:zlib and DecompressionStream as affected APIs. In other words, even if developers have not explicitly implemented decompression, the vulnerable decoder may run inside the APIs they use.
Imperva, which published its verification results on October 22, confirmed that code execution can actually be achieved. The company reports that on an official Node.js 24.22.0 build in a Linux arm64 environment, it achieved code execution both through a response received by an outbound fetch and through an HTTP request received by Express/body-parser with decompression enabled. With the fixed version 24.22.1, the same input was rejected. The code-execution demonstration did not use a debugger or a binary modified for instrumentation, and Imperva distinguishes it from the memory-sanitizer testing it performed to investigate the root cause.
That said, Imperva's demonstration did not succeed on every attempt. The Express/body-parser result also reflects a specific combination of version and configuration, and not every intermediate version in the affected range was tested individually. Nor will other CPU architectures or all Node.js builds necessarily yield the same result. Bun also states that it has not demonstrated an RCE attack in its own project, so Node.js's success cannot be applied to Bun as is. These are reports that an attack worked in specific test environments, and do not mean that actual damage or exploitation by attackers has been confirmed.
Fixed versions and update targets for Node.js, Bun and Envoy
Node.js fixed the vulnerability in 22.23.4, 24.22.1 and 26.12.1, and Bun incorporated the fixed Brotli 1.2.1 in 1.4.4. Envoy also has fixed versions for multiple release lines. However, where fixes need to be applied and the conditions for being affected differ by product. Based on official information as of October 24, 2026, the picture is as follows.
| Product | Official fixed versions | Update targets and notes |
|---|---|---|
| Node.js | 22.23.4 / 24.22.1 / 26.12.1 | Update the runtime in operation. If it is embedded in containers or similar, rebuild the images and check the actual version after redeployment. |
| Bun | 1.4.4 | Besides the runtime, also rebuild executables created with bun build --compile. Already distributed executables are not fixed by updating Bun on the host. |
| Envoy | 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8 / 1.36.12 | Applies to environments with Brotli decompression enabled. Even if you disable the filter, check whether the forwarding destination decompresses the compressed data. The 1.36 line is no longer supported. |
With Bun, special attention is needed because an executable created with bun build --compile embeds the Bun runtime itself. Updating Bun in the development environment or at the distribution destination does not change the contents of executables already created. According to the official advisory, affected versions are 1.0.21 and later but earlier than 1.4.4, and executables built with them remain vulnerable until rebuilt. To complete the fix, distributed executables must also be updated or replaced.
For Envoy, having Brotli decompression enabled is the condition for being affected. Disabling the decompression filter prevents the vulnerable decoder from running at that point, but if an application at the forwarding destination decompresses the compressed data, separate measures are needed. Patch the Planet also cautions that although fixed version 1.36.12 has been released, the 1.36 line itself is no longer supported. Whether a vulnerability has been fixed and whether the release line in use is still supported must be checked separately.
Version numbers alone cannot always determine safety. According to Bun's advisory, the affected range of Brotli itself is 1.0.3 to 1.2.0, with the already fixed 1.0.10 and 1.1.1 as exceptions. Where fixes have been backported to older lines in this way, judgments must be based on each product's official announcements. Severity ratings also vary by product: Node.js rates it "High," while Envoy rates it "Critical," with a CVSS 4.0 score of 9.2. The table above organizes update targets for each product; it is neither exhaustive of all affected products nor a comparison of risk across products under the same conditions.
Interim measures until updating, and confirming fixes reach production
For responses fetched from external servers, it is necessary to distinguish between removing br from the Accept-Encoding header and disabling automatic Brotli decompression. Accept-Encoding is the header with which a client tells the server which compression formats it accepts, and even if br is not specified, there is no guarantee the other party will not return a Brotli-format response. Patch the Planet's guidance calls for either rejecting fetched responses before decompression or turning off automatic decompression altogether. Simply telling the other party which compression format you prefer cannot fully block the path by which data reaches the vulnerable decoder.
The decompress: false option available in Bun's fetch both removes br from Accept-Encoding and stops automatic decompression of the response. However, this setting applies only to the specific fetch request it is given and does not stop decompression performed by other APIs. Bun's official advisory also explains that affected versions have no process-wide workaround. Stopping response compression on the CDN side does not address decompression performed on inbound requests or outbound communication. WAFs and data size limits likewise may not prevent every attack path on their own and should be treated as stopgap measures.
When the Brotli decompression filter is disabled or removed in Envoy or Istio, compressed data is forwarded downstream without being decompressed. If the application beyond that point decompresses Brotli, the possibility remains that malicious data will reach the vulnerable decoder. Therefore, do not conclude that mitigation is complete just because the filter has been stopped; the downstream decoder must be checked as well. It is important to examine both HTTP request and response directions, as well as paths by which data arrives without passing through the filter, and to confirm that compressed data from outside can be safely rejected.
The fundamental fix is to replace the vulnerable Brotli implementation with a fixed one. If runtime or container image versions are pinned, change the specification to a fixed version and rebuild images or executables as needed. Then restart and redeploy not only web services but also workers and scheduled jobs, and confirm that the update has reached every replica. Only after matching the versions of distributed executables against the runtimes actually in operation, and verifying that no old implementation remains on any path that decompresses external data, can the remediation be considered complete.