Patch the Critical Brotli Decoder Vulnerability

October 24, 2026 • 3 min read

Google’s Brotli compression library has a critical bug in its decoder, CVE-2026-111497. A crafted Brotli stream can make the decoder write past the end of a buffer, which can crash the process, leak memory or run code. GitHub’s advisory rates it CVSS v4.0 9.2.

Every version from Brotli 1.0.3 through 1.2.0 is affected. Brotli 1.2.1, released on October 21, fixes it, along with 1.0.10 and 1.1.1 on the older branches.

Brotli is used almost everywhere HTTP compression is, so the list of affected software is long: Node.js, Bun, Python packages, curl and proxies like Envoy all decode it. Let’s look at who’s exposed, where the fixes are, and how to stop decoding Brotli until you’ve patched.

Who’s exposed #

Only the decoder has the bug. If your software only compresses responses with Brotli, it isn’t affected. You’re exposed if something in your stack decodes Brotli that someone else controls:

• Responses fetched from servers you don’t control, by an HTTP client that decompresses automatically
• Request bodies sent with Content-Encoding: br, if a proxy or framework decompresses them
• Files compressed with Brotli, including WOFF2 web fonts

HTTP clients are the easiest to miss. I tested PHP’s curl extension, using libcurl 8.22.0 with Brotli 1.2.0, against a server that always answers with Brotli. It decoded the response even when the request only asked for gzip, so taking br out of Accept-Encoding isn’t enough.

Where the fixes are #

Node.js and Bun bundle their own copy of Brotli, so update the runtime itself. The Node.js advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting it.

On Ubuntu, curl and the software built on it use the system’s Brotli library, libbrotli1. libcurl4 depends on it, so PHP’s curl extension uses it too. Ubuntu 22.04 ships 1.0.9 and Ubuntu 24.04 ships 1.1.0. Both are affected, and as of October 24 neither has a security update.

Envoy and Istio are only affected if you’ve configured a Brotli decompressor filter.

Blocking Brotli until you can patch #

Where a fix isn’t available yet, stop decoding untrusted Brotli and keep your other compression on:

• Incoming requests: reject Content-Encoding: br before any proxy, middleware or body parser decompresses the body.
• HTTP clients: turn off automatic Brotli decompression, or reject Brotli responses before the body is decoded. In PHP code that uses Guzzle, 'decode_content' => false stops the decoding, though gzip responses then come back compressed too.
• Envoy and Istio: disable the Brotli decompressor filter for both requests and responses.
• Files: pause processing untrusted Brotli files until the decoder is patched.

Turning off Brotli compression on your CDN or web server doesn’t help, because that’s the compressing side. Patch the Planet, from OpenAI, has configuration for Express, Next.js, Python clients and Envoy.

After patching #

Running processes keep the old library loaded until they restart. After you update a system library like libbrotli1, restart every service and worker that might decode Brotli, including PHP-FPM.

Distributions such as Ubuntu ship fixes as backports, so the version number may stay the same. Check the package changelog for CVE-2026-111497 instead.

So update every runtime and library that decodes Brotli, restart whatever uses them, and block Brotli decoding anywhere a fix isn’t out yet.