In-depth analysis · About 6 min read
Brotli decoder disclosure: a patch must reach every running copy
Node.js documents CVE-2026-111497; a deployment advisory maps downstream fixes and temporary controls, with important decoding and support-lifecycle limits.
- Published here
- Source published
- Source checked
Node.js documents CVE-2026-111497, reported by OpenAI Codex Security, while PatchthePlanet maps downstream fixes and temporary controls. The case illustrates the gap between repairing a shared library and protecting deployed software. Exposure depends on untrusted data reaching an affected decoder; using Brotli alone does not prove that every deployment is vulnerable.
Listen to the news
Read this article aloud or keep listening to the news.
Preparing the reader…
Device voice
Speech is handled by your browser or device. AISubHub does not send the text to an audio API. Voice availability and playback with a locked screen vary by device.
Resuming may repeat a short phrase.
At a glance
- Node.js lists fixes in 22.23.4, 24.22.1 and 26.12.1; the flaw can corrupt memory when an application decompresses attacker-supplied Brotli data.
- The deployment advisory lists Bun, Envoy, Istio and upstream Brotli fixes, but warns that a patched release on an unsupported branch is not a supported upgrade path.
- Temporary controls must block untrusted Brotli before decoding on every relevant path. Disabling output compression or removing br from Accept-Encoding alone is insufficient.
Disclosure and source dates
The Node.js advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security for reporting the Brotli vulnerability, and mcollina and aduh95 for its fix. PatchthePlanet’s deployment guide maps affected software to releases and temporary controls. AISubHub’s practical interpretation is that protection must travel through component releases, embedded runtimes, rebuilt applications and running user deployments; installing one package does not by itself establish completion.
The Node.js page carries an October 21 security-release title, but does not date the addition of each CVE entry. PatchthePlanet says Updated October 23, which is not its original publication timestamp. These dates do not establish when every downstream fix reached users. AISubHub read these public materials on October 24; an access date is separate from a release-page heading or an update label.
How eight bytes become unsafe
Node.js explains that an invalid block switch was treated as a temporary need for more input instead of a permanent format error. The streaming decoder continued appending bytes to an eight-byte internal buffer and could write beyond it. For an application decompressing attacker-controlled data through node:zlib, possible consequences include a crash, memory disclosure or remote code execution.
The relevant boundary is decoding untrusted input: request bodies, responses from untrusted servers and compressed files. Only compressing outgoing data does not establish exposure. The advisory also flags embedded runtimes, curl/libcurl, Python or Java bindings, font decoders and file readers. An Electron application can contain separate Chromium and Node.js copies; fixing one does not establish that both are fixed.
Select a supported component release
Node.js names 22.23.4, 24.22.1 and 26.12.1. PatchthePlanet lists Bun 1.4.4, including Brotli 1.2.1, and upstream Brotli 1.0.10, 1.1.1 and 1.2.1 for their respective library branches. These are component-specific releases, not one version number that repairs every application embedding the decoder.
The same advisory lists Envoy 1.40.0, 1.39.3, 1.38.6 and 1.37.8. Envoy 1.36.12 includes the fix, but that branch is unsupported. Istio fixes are 1.29.9, 1.30.6 and 1.31.2; 1.29 is end of life. Both exceptions require attention to supported upgrade paths, rather than treating patch inclusion as ongoing maintenance.
Block input before decoding
PatchthePlanet recommends temporarily disabling Brotli decoding of untrusted data when immediate patching is impossible. Its Express example permits identity, gzip and deflate before every body parser, rejecting other or stacked encodings with HTTP 415. A proxy decoding first needs its own protection. The fallback inflate:false rejects all compressed request bodies, including gzip and deflate.
For fetched responses, removing br from Accept-Encoding is only a preference: a server can still send Brotli. The Python example delays body reading and decoding until Content-Encoding has been checked. Redirects and retries are disabled in that example; adding them requires checking every response. Ordinary fetches or automatic reads may decode before an application inspects headers. Size limits and WAF rules alone do not cover every path.
Workarounds have bounded scope
For Envoy and Istio, the advisory disables the Brotli decompressor in both directions, removes runtime overrides that could re-enable it, and warns that omitted directions default to enabled. Separate gzip or zstd filters should remain; their shared filter name is not a reason to remove them all. Encoded bytes can pass downstream, so application decoders still need protection.
The Next.js workaround sets images.unoptimized globally, followed by rebuilding and redeploying, then checks that /_next/image no longer runs the built-in optimiser. It does not protect custom loaders, other server-side fetches or other decoders. For Istio, effective configuration must be checked on each gateway and sidecar; editing one configuration file is not proof that the running fleet changed.
Check the running deployment
The advisory calls for updating runtime and image pins, rebuilding bundled containers or executables, and restarting or redeploying services, workers, scheduled jobs and replicas. Check the running binary or image against the relevant fixed release. A downloaded patch, updated build host or repaired browser component does not demonstrate that every process uses the corrected decoder.
As an AISubHub hypothetical, a CDN might compress outgoing responses while a separate worker decodes fetched content. Disabling CDN compression would leave that worker’s exposure unchanged; an alternate origin route might also bypass a proxy guard. This is an architectural example, not an inspection of our servers. Verification should cover relevant paths and confirm that permitted compression still works.
Why it matters
The actionable lesson is to inventory where decoding happens and connect upstream fixes to rebuilt, running deployments. Version checks and temporary guards serve different roles; neither a shared library name nor a single configuration change proves fleet-wide protection.
Limits and availability
We reviewed the two public advisories, not exploit code, every linked release note or deployed customer systems. Non-Node version details are attributed to PatchthePlanet’s October 23 review. We performed no exploit, runtime upgrade or server audit, and the materials do not establish widespread attacks or universal remediation.
Sources and evidence
Source published: · Source checked:
Further reading
AI-assisted editorial articles checked against linked primary sources. Vendor claims are attributed; inclusion is not endorsement.