Brotlipocalypse

What it is

CVE-2026-111497 is an out-of-bounds write in c/dec/decode.c of google/brotli, affecting versions 1.0.3 through 1.2.0. OSM Security (Paul McCarty, 24 October 2026) argues the main risk is not the upstream library but the many copies of the decoder vendored into other software. Each copy needs its own fix, and updating Node.js or the distro's libbrotli does not cover them. Imperva showed the bug can become code execution in Node.js. OSM says denial of service is relatively easy to get in its own testing.

How it works

When a stream requests a block-type switch it is not allowed to make, the old decoder reports "I need more input" instead of "this stream is broken". A streaming decoder then keeps appending input into an 8-byte internal buffer and writes past its end.

The fix commit is 0ed4268a ("Detect and report invalid stream earlier"). It reached google/brotli master on 27 February 2026 with no release and no advisory, eight months before it was identified as a security fix.

Preconditions / Affected

• Only the decoder is affected. Compress-only software such as nginx's ngx_brotli filter and Apache's mod_brotli is not.
• Fixed upstream releases are 1.0.10, 1.1.1 and 1.2.1, all tagged 21 October 2026.
• The post names these as carrying their own copy: the .NET runtime, DuckDB, Pillow, pyarrow, and native extensions for Ruby, PHP, Java and Rust. Brotli-compressed Parquet files and WOFF2 fonts are listed as input paths.
• Python advisories are PYSEC-2026-4322 (brotli) and PYSEC-2026-4323 (brotlicffi), both under GHSA-9v8h-qqgm-4m35.

What to do

Check vendored copies. A fixed copy contains the new error code, so no match means not fixed:

grep -r BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH path/to/vendored/brotli/

Run it over vendored code, container images and site-packages, node_modules and gem directories. Look for decode.c or decode.cpp next to brotli in the path.

For a git submodule, test whether the pinned commit contains the fix or one of its three release backports:

git -C google-brotli merge-base --is-ancestor 0ed4268a <submodule-sha> && echo fixed

For build-time downloads, read the pinned version from the build files.

Fixed versions listed:

• Node.js 22.23.4, 24.22.1, 26.12.1
• Bun 1.4.4
• PyPI Brotli 1.2.1 and brotlicffi 1.2.1.0
• Perl IO::Compress::Brotli 0.023
• andybalholm/brotli (Go) v1.2.7
• Chrome 148+, Firefox 150+ (ESR 140.10+), Electron 42+, fixed by re-vendoring with no advisory
• Envoy: latest patch on each supported line
• Unity's Mono fork: fix merged 22 October
• vcpkg, Conan Center, Homebrew, MSYS2 and conda-forge: Brotli 1.2.1 available

Where no fix exists, stop decoding Brotli from untrusted sources:

• Remove br from Accept-Encoding on outbound requests. In .NET, leave DecompressionMethods.Brotli off.
• Reject Content-Encoding: br on inbound requests.
• Do not open Brotli-compressed Parquet files or WOFF2 fonts from untrusted sources.

Replace abandoned packages: iltorb, jvm-brotli, brotlipy, brotli-sys. Then rebuild, because the copies are compiled into wheels, gems, JARs and container images, and a fixed library does nothing until the embedding artifact is rebuilt.

Caveats

The list of affected projects is incomplete. OSM says coordinated disclosure is still under way and it will update the post over several days. The .NET runtime, DuckDB, Pillow and pyarrow are named as bundling copies, but the post gives no fixed versions for them. The Log4j comparison and the ease of RCE are OSM's own assessment.