Node.js patches Brotli flaw and blocks reportedly compromised certificate keys

Microsoft and Ruby package fixes

Microsoft released .NET fixes outside its normal schedule on October 25; Ruby’s brotli package received a fix on October 24. These patches and additional exposure paths were detailed in The Hacker News’s October 24 article, expanded on October 26.

Microsoft says an affected package alone does not expose a .NET application. The application must decode attacker-controlled Brotli through ASP.NET Core request decompression, HttpClient response decompression or direct decoding calls. The first two options are off by default. .NET Framework is not affected.

Microsoft describes possible memory disclosure or corruption, denial of service—making an application unavailable—and elevation of privilege, meaning access beyond an attacker’s existing permissions. Its advisory does not list remote code execution as an outcome. JFrog demonstrated a crash in a .NET test program through its Brotli interfaces.

Applications using the shared .NET runtime need the updated runtime and a restart. Self-contained and NativeAOT applications, which carry the decoder in their executable, must be rebuilt and republished. Container images must be rebuilt from updated .NET images.

While awaiting an update, Microsoft advises disabling Brotli in existing request-decompression and HttpClient configurations. It warns against adding decompression where it is not already used, because that can introduce denial-of-service risks. Ruby’s fixed brotli gem bundles Brotli 1.2.1 and uses that copy instead of an unpatched system library.

JFrog identifies image and data-file paths to the flaw

JFrog said on October 25 that the flaw also reaches FFmpeg, ClickHouse and Apache Arrow. Some paths begin with a file, so a firewall rejecting web requests marked Content-Encoding: br does not cover them.

FFmpeg reaches Brotli through libjxl, a library that unpacks metadata inside JPEG XL images. A crafted image let JFrog control the instruction pointer, which determines what code runs next. JFrog said achieving code execution would require more work. It did not report an FFmpeg-specific fix; updating the Brotli library used by libjxl closes this path.

ClickHouse, an open-source database, decodes Brotli in web-request bodies, .br files and Parquet data files, its fix proposal says. JFrog crashed a server with one crafted request of about 23 MB, demonstrating denial of service rather than claiming code execution. No patched release had shipped when JFrog published. A change updating the bundled Brotli to 1.2.1 was merged into ClickHouse’s 26.9 branch on October 26.

An Apache Arrow tracker issue says its C++ builds bundle Brotli 1.0.9 and can reach the flaw through Parquet or Arrow IPC files containing Brotli-compressed data. Builds linked to a patched system Brotli library are unaffected. As of October 26, the issue had no linked fix or maintainer reply.

In pyarrow, Arrow’s Python package, JFrog found that a 534-byte input made decompression loop endlessly and keep the processor busy: denial of service, not a crash or code execution.

Other available fixes

Fixes detailed on October 24 covered Bun, Python packages, Envoy and Istio. Debian patched its version 13 package on October 23. The exposure conditions matter as much as the installed version.

Installing either Python Brotli package can make HTTP clients decode Brotli responses automatically, even without an import in the application’s code. In Envoy and Istio, the flaw cannot be reached when Brotli decompression is off.

Python advisory entries PYSEC-2026-4322 and PYSEC-2026-4323 were added on October 23. Dependency scanners may still miss the packages: the vulnerability record identifies Google’s repository rather than the Python packages, and some scanners’ advisory data lacks an affected-package entry. Maintainers should also check installed versions manually.

How the flaw reaches Node.js applications

The flaw, CVE-2026-111497, lets malformed compressed data make the decoder write beyond its allocated memory buffer. This out-of-bounds write can cause a crash, expose process memory or potentially let an attacker run code. Node.js rates it high severity; Google rates it critical, at 9.2 on the CVSS 4.0 vulnerability-scoring scale.

In Node.js, the defect is in bundled code, not the application’s own program, and affects unpatched 22.x, 24.x and 26.x releases. The built-in fetch() function decodes responses marked Content-Encoding: br, the header identifying Brotli compression. Applications can also reach the decoder through node:zlib or middleware, software that processes incoming requests.

A plain Node.js web server does not decompress a request body merely by receiving it. Express 5’s body parsers do decode Brotli when applied to a route. Node.js imported the upstream fix, which makes the decoder reject invalid input with a format error instead of continuing beyond the buffer.

Imperva demonstrates code execution on one Node.js build

An October 23 account described Imperva researchers running attacker-supplied code on the official Node.js 24.22.0 image for Linux ARM64, without a debugger or custom build. They delivered data through fetched responses and Express request bodies. Success took several attempts and covered one build and application setup; other processor architectures and the 22.x and 26.x lines were not tested.

The first public demonstration, published on October 22, achieved code execution only on a deliberately weakened build. Its author reported a crash and limited access to process memory, but not code execution, on a standard build. Imperva’s later test went further; patched Node.js 24.22.1 rejected the same input and no code ran.

Imperva has not released its exploit. Comparable code execution has not been demonstrated on the other affected products, and no exploitation in the wild has been reported.

A source-code fix preceded the security release

OpenAI said on October 23 that it found the flaw while teams of superintelligence (SI) agents tested its containment safeguards by trying to escape restricted computing environments. The company said malicious compressed data could let attackers run code on systems using Node.js, Bun or Envoy.

The underlying defect was corrected in Brotli’s source code—the code used to build the software—on February 27, before its security implications were recognized. No release carried the fix until October 21. OpenAI said Brotli released updated versions and published a public vulnerability record after the company’s disclosure.

The separate certificate-key block

The Node.js releases also block eight intermediate certificate-authority keys from eMudhra that were reported compromised. These keys help establish whether a server’s certificate can be trusted. Node.js uses Mozilla’s root certificate list but does not check certificate revocation by default, so a certificate chain relying on a compromised key could previously pass validation.

The block is built into the updated releases. Connections resumed from a session established before the update are not checked again until that session times out.

Update each copy; firewall coverage is limited

The fixed Node.js releases remain those issued on October 21:

Node.js 20.x and earlier have reached end of life and receive neither the Brotli fix nor the certificate-key block. Users need to move to a supported line. The advisory offers no temporary workaround within Node.js itself.

Vercel, which runs Node.js for customers, said it added firewall rules on October 21 to block incoming attacks. Those rules do not cover Brotli responses applications fetch from other servers and do not replace updating the runtime or library.

Cloudflare added two managed firewall rules on October 25, including one matching incoming requests marked Content-Encoding: br. Both only log matching traffic by default; they block nothing unless the customer changes their action.

For software awaiting an update, OpenAI recommends rejecting untrusted Brotli requests before decompression and disabling automatic Brotli decoding in clients while rejecting Brotli responses before decoding. Removing both Python Brotli packages lets clients fall back to gzip and deflate compression. These measures depend on controlling the decoding path; they are not a published workaround within Node.js.

Removing br from the Accept-Encoding request header is not enough, because a server can still return Brotli data. Maintainers need to install fixed versions, rebuild affected container images and restart services: a running process retains the old decoder until it restarts.