The awkward part is that the tools you'd normally rely on to tell you about it may stay quiet. So here's what's going on, what to check, and what to do if you can't patch straight away.

What's actually broken

Brotli is a compression format from Google. Browsers and servers use it to shrink web traffic, and plenty of libraries quietly decompress it for you whenever a response or request arrives compressed that way.

The flaw, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder. In plain English: feed it a deliberately malformed compressed stream and it writes past the end of a small internal buffer. The Node.js security team describe the possible results as a crash, memory disclosure or remote code execution. Node.js rates it High. The OSV vulnerability database gives it a CVSS 4.0 score of 9.2, which is Critical.

Google released fixed versions of Brotli on 21 October: 1.2.1, plus 1.1.1 and 1.0.10 for older lines. The affected range is 1.0.3 to 1.2.0, which covers years of releases.

Who needs to care

Brotli doesn't sit on its own. It gets bundled into other things, and that's where it turns up in a small business's systems without anyone choosing it.

  • Node.js. It bundles Brotli. The Node.js security release on 21 October fixed it in 22.23.4, 24.22.1 and 26.12.1, alongside nine other fixes, three of them also rated High. If your app decompresses Brotli data through node:zlib, it's in scope.
  • Python. The Brotli and brotlicffi packages on PyPI are both affected. Fixed versions (Brotli 1.2.1 and brotlicffi 1.2.1.0) went up on 22 October. Aikido's write-up points out that common HTTP libraries such as requests, urllib3, httpx and aiohttp use these packages automatically if they're installed.
  • Everything else that bundles it. Aikido also lists curl, Bun, Envoy and Istio, along with operating system packages. For those, check the vendor's own advisory.

One thing worth saying plainly. If you're still on Node.js 20 or older, there's no patch coming. Node.js 20 reached end of life in April, and the Node.js team's line is that end-of-life versions are always affected when a security release lands. That's the push to upgrade you may have been putting off.

Why your scanner might not tell you

This is the bit that caught my eye. A lot of firms lean on Dependabot, pip-audit or similar tools to flag vulnerable packages. That's sensible, and it mostly works.

But those tools match vulnerabilities to package names. When I checked the OSV entry for this CVE, it listed the Brotli Git repository as the affected package, not the PyPI packages. Aikido make the same point, saying advisory databases don't map the CVE to either PyPI package. So a clean scan report doesn't mean you're clear on this one.

Their advice is blunt:

Treat it as urgent anyway.

I'd agree. A scanner is a safety net, not a substitute for someone who knows what's in your stack.

What to do this week

None of this is complicated, but it does need doing properly. Here's the order I'd go in.

  • Find out where Brotli lives. Check your Node.js version on every server and build. For Python, look in your lockfile or run pip show brotli brotlicffi in each environment. Don't forget Docker images, which carry their own copies.
  • Upgrade. Move Node.js to 22.23.4, 24.22.1 or 26.12.1. Bump Brotli to 1.2.1 and brotlicffi to 1.2.1.0. Update the lockfile so the fix sticks.
  • Rebuild and restart. A patched package sitting on disk doesn't help a process that's still running the old code. Rebuild container images, redeploy, restart services.
  • Prioritise the exposed bits. Aikido suggest starting with services that accept compressed request bodies or call out to external servers. That's where untrusted Brotli data is most likely to arrive.

If you genuinely can't upgrade yet, Aikido list some stopgaps. In Python you can uninstall Brotli and brotlicffi, since the HTTP libraries will simply stop asking for that compression. You can also reject inbound requests with a Brotli content encoding at your proxy. For outbound calls, removing br from the Accept-Encoding header isn't enough by itself; you also need to reject Brotli responses before they're decoded. These buy time. They aren't a fix.

The bigger point for small firms

This is the third big "patch it now" story in a week, after PHP and GitLab. I'm not saying that to frighten anyone. It's just what running software looks like now. The code you wrote is only part of what you run. The rest is a pile of libraries, and libraries inside libraries, that someone has to keep an eye on.

Bigger companies have a team whose job that is. Most small firms have a developer who left two years ago, or an app someone built quickly with an AI tool, and nobody's quite sure what's inside it. That's not a criticism. It's normal. But it does mean weeks like this one land differently.

If you'd like someone to keep this side of things under control, our software support and maintenance plans cover keeping frameworks and dependencies patched, with monitoring so problems get spotted early. For firms that want more than that, our outsourced tech department handles planning, servers and security as well as the code. And if you've got an AI-built app and you'd like to know what you've actually got, the AI code audit gives you a written report within five working days.

Not sure if any of this applies to you? Drop us a line or book a 15-minute call and we'll tell you honestly whether it's worth worrying about.

Cheers, Rob