Cybersecurity/Published 24 October 2026/5 minute read

Critical Brotli flaw: what businesses using Node.js, Bun and Envoy should check

OpenAI reported a serious flaw in the Brotli decoder. Learn when your web application is exposed, which updates are available and how to verify the patch.

Omar Geerman

OpenAI reported a serious vulnerability in Brotli, a library bundled with software including Node.js, Bun and Envoy. The flaw, CVE-2026-111497, can cause a crash, expose process memory or allow attacker-controlled code to run. Node.js credits OpenAI Codex Security with the report. Businesses running web applications should check their software and the available patches.

What does Brotli do?

Brotli reduces the size of data sent across a network. At the receiving end, a decoder expands that data again. The flaw is in this decoding step. It affects software using a vulnerable decoder to process data that an outside party can influence.

When can an attacker reach the flaw?

A malformed Brotli stream can make the decoder write beyond its allocated memory. An attacker does not need an account, but the application must decode the malicious data using an affected build. A server running Node.js does not, by itself, establish that such a path is reachable.

Incoming traffic: a server or proxy decompresses a Brotli request supplied by an attacker.
Outgoing traffic: an application fetches data from another server and decompresses its malicious Brotli response. Background jobs and API integrations therefore need attention too.
Client software: an affected program processing compressed responses may also be exposed. This does not establish that every device or browser is automatically vulnerable.

Which updates are available?

The following fixes are confirmed as of 24 October 2026. Google rates the library flaw as critical; Node.js rates the impact within its product as high. Also check the current advisory for your distributor, particularly if it has backported a security fix into an older package version.

Node.js: 22.23.4, 24.22.1 and 26.12.1 include the fix in their respective release lines. Use an updated, supported release; unsupported older lines require migration.
Bun: version 1.4.4 bundles Brotli 1.2.1, verified in the source for that release tag. Update compiled executables and container images as well.
Envoy: its advisory lists 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12 as patched. The described exposure applies to deployments with the Brotli decompressor configured.
Brotli itself: security releases are available for the 1.0, 1.1 and 1.2 lines: 1.0.10, 1.1.1 and 1.2.1 respectively. Updating a separate library does not automatically replace copies embedded in other software.

What does this mean for your business website?

Ask your administrator which software actually runs your website, customer portal, webshop and integrations. Include jobs running behind the scenes. With managed hosting, the provider may handle runtime updates; with your own servers and containers, that responsibility often sits with your developer or operations team. An updated laptop tells you nothing about the version serving production.

Vercel reports a rollout of Node.js patches alongside firewall rules. Those rules do not cover malicious responses fetched by a function from another server. Projects on Node.js 20 must move to a supported line and redeploy; Vercel manages patch versions for 22 and 24. Ask other hosting providers for their own confirmation.

A practical patching checklist

Inventory runtimes and embedded libraries across the relevant services, including workers, containers and integrations.
Identify where data from visitors or external servers is decompressed, and compare deployed builds with vendor advisories.
Update the runtime or vendor package. Updating npm dependencies alone may leave Node.js's embedded Brotli decoder unchanged.
Rebuild images and bundled applications where needed, deploy the update and restart every affected process and replica.
Verify the version actually running and test logins, forms and external integrations. Record any remaining gaps.

If patching immediately is not possible, discuss temporarily stopping the decoding of untrusted Brotli data with your administrator. This must happen before the decoder runs and cover both requests and fetched responses. A firewall or removing 'br' from a request header is not a complete solution on its own.

From an alert to a verified update

The most useful question for your provider is specific: which services were checked, which builds are running now, and what was tested after the update? That turns a general security alert into an actionable maintenance task. The disclosure alone is not evidence that your business has been compromised, but it deserves timely follow-up.

Sources and version checks

Checked on 24 October 2026 against the project advisories and release sources below. Consult the latest vendor information when carrying out an update later; these version boundaries concern CVE-2026-111497 specifically.

Need help with a Brotli or Node.js security update?

Geerman Web Solutions helps businesses identify which web applications, integrations and servers need attention. We check the runtime and hosting, coordinate updates with your provider, update the application or container where needed, and test the main functions after deployment. Get in touch with your website address and what you know about your hosting so we can agree on a practical next step.