The Node.js Brotli bug also hits Python, curl and Envoy
Security researchers traced CVE-2026-111497 well past Node.js, finding the same unpatched Brotli decoder in Python packages with 82.8 million monthly downloads, plus curl, Envoy and Istio.
CVE-2026-111497, the out-of-bounds write in Google’s Brotli decoder that Node.js patched on 21 October, turns out to reach far past Node. Aikido Security reported on 23 October, updated the next day, that the same bug sits in Brotli versions 1.0.3 through 1.2.0, which ship inside Python’s brotli and brotlicffi packages, curl and libcurl, Envoy, Istio, and any C++ code linking the upstream library.
Python’s brotli package alone sees 82.8 million downloads a month, and it does not need to be called directly: requests, httpx and aiohttp all pull it in as a transitive dependency and will trigger the bug if a server sends back a crafted Brotli-encoded response. Fixed versions are Brotli 1.2.1 and brotlicffi 1.2.1.0. Node.js, Bun and Chromium already have fixes; bundled copies inside .NET, PHP, Ruby, DuckDB, ClickHouse, Arrow, MuPDF and 7-Zip are still exposed as of this post.
python -c "import brotli; print(brotli.__version__)"Why it matters: this is not a Node-specific flaw, it is a decompression library almost every HTTP stack touches without choosing to. If you upgraded Node last week and stopped there, check Python, curl and any proxy or service mesh in the request path too.
The caveat: Aikido has not confirmed exploitation in the wild, and says advisory databases have not yet mapped the CVE to the affected PyPI packages, so automated scanners may miss it.