A Brotli vulnerability can turn the routine task of unpacking compressed data into memory corruption and possible remote code execution. The problem is confirmed in Node.js’s October 21 security release and an Envoy advisory published October 23. Both identify the underlying issue as CVE-2026-111497.
Brotli reduces the size of data transferred across the web. The danger here lies in decoding malformed input, not in the mere presence of a website or JavaScript. For Node.js, the project says an attacker must be able to supply Brotli data that an application decompresses through its bundled library.
What the Brotli vulnerability can do
The Node.js notice describes a decoder writing beyond an internal buffer. Possible consequences include a crash, disclosure of process memory or execution of attacker-controlled code. It rates the issue high and identifies the 22.x, 24.x and 26.x lines as affected.
Envoy, a proxy used to handle application traffic, rates its advisory critical. Crucially, its stated impact covers deployments with a Brotli decompressor configured. The advisory describes potential exploitation without authentication, including memory disclosure, denial of service and arbitrary code execution. That is a serious exposure condition—not evidence that every Envoy installation is vulnerable or has been breached.
The fix follows the component
Node.js issued fixed releases 22.23.4, 24.22.1 and 26.12.1 on October 21. Envoy lists fixes in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. These are separate product release paths; updating one does not establish that the other was patched.
The upstream Brotli 1.2.1 release also explicitly lists the security fix. Software that bundles a library still needs a product-specific update or verified patched build.
This is distinct from the PHP vulnerabilities NeonPulse covered earlier: a different component, identifier and exposure mechanism. The vendor notices establish a flaw and available fixes; they do not, by themselves, establish a successful attack campaign.
Our assessment: the operational priority is to identify who supplies the running decoder and whether it processes untrusted input. A reassuring application version alone cannot answer that question. The dangerous boundary is where outside data becomes work performed inside a privileged service.
