Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

The vulnerability affects programs that unpack Brotli-compressed data, including Bun, Python's Brotli and brotlicffi packages, and Envoy proxies configured for decompression. Imperva researchers have demonstrated that code can run on unpatched Node.js builds, though no real-world attacks have been reported to date.

Affected Software

Node.js and Bun are vulnerable when their built-in fetch() reads Brotli-compressed responses or when Express 5 and body-parser 2 process Brotli uploads. Envoy and Istio are only at risk when Brotli decompression is enabled through filters. In Python, any application using HTTP clients like requests, urllib3, httpx, or aiohttp is potentially exposed if the Brotli or brotlicffi packages are installed.

Exploitation Details

Imperva's Red Team successfully ran attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64, though the exploit required multiple attempts and hasn't been released publicly. OpenAI describes the flaw as enabling unauthenticated remote code execution in Brotli.

Severity ratings vary: Google rates it 9.2 (critical) on CVSS 4.0, Node.js calls it high, and Red Hat rates it 8.1 (important). CISA has recorded exploitation as "none" and automation as "no," while Red Hat notes no reliable public proof-of-concept exists for running code.

Patch Timeline

The fix was added to Brotli's source code on February 27 but wasn't recognized as a security vulnerability until OpenAI reported it. Node.js and Google released fixes on October 21, with other products following suit. Debian fixed its brotli package for Debian 13 on October 23, while Amazon Linux 2023 still listed packages as pending fixes as of October 22.

Recommended Actions

Users should update to fixed versions and restart services to ensure the patched decoder is loaded. Where updates aren't possible, experts recommend rejecting incoming requests with Content-Encoding: br before decoding, disabling automatic Brotli decoding in HTTP clients, and uninstalling Brotli packages in Python to force fallback to gzip and deflate.

Dependency scanners may not flag affected Python packages yet, as GitHub's advisory still lists no affected package. Advisory entries for PYSEC-2026-4322 and PYSEC-2026-4323 were added on October 23, so manual version checking is recommended.