The Node.js Brotli flaw isn't just Node. Check your Python apps and servers too

If you updated Node.js after my post yesterday, good. But the worst flaw in that release wasn't really a Node bug. It's in Brotli, a compression library that plenty of other software uses, and that includes Python apps and the system library that curl uses on most Linux servers.

So if you run anything written in Python, or you just have a Linux server that makes web requests, it's worth half an hour this week.

What happened

The flaw is CVE-2026-111497. Brotli is a way of squashing web traffic so it downloads faster, and the bug is in the code that unpacks it. According to the CVE record, it affects Google Brotli versions 1.0.3 through 1.2.0, and a crafted Brotli stream can let a remote attacker with no login corrupt memory, leak data, crash the program, or "potentially execute arbitrary code".

Google rates it 9.2 out of 10. Red Hat scores it lower, at 8.1. Google has released fixed versions on GitHub: 1.0.10, 1.1.1 and 1.2.1.

On 22 October GitHub published an advisory confirming that the Python packages brotli and brotlicffi are affected too. The fixed versions are 1.2.1 and 1.2.1.0.

As far as I can see there's no public report of anyone using it in real attacks. The CVE record says the same. But researchers at Imperva have already shown code execution against an unpatched Node.js, so I wouldn't leave it long.

Does it affect you?

You run a Python app. Security firm Aikido points out something easy to miss. Popular libraries such as requests (through urllib3), httpx and aiohttp use Brotli automatically if it's installed, so your code doesn't have to mention it. Aikido also notes that, as of 23 October, advisory databases weren't linking the CVE to the Python packages, so tools like Dependabot or pip-audit may not warn you yet.

You have a Linux server. Most will have the system Brotli library installed. On Debian, for example, the curl library depends on it. That's fixed through your normal security updates once your distribution ships a fix.

You're on managed hosting or a platform. Your provider deals with the system library. Your own app's Python packages are still your job, so check them.

Your website runs on plain nginx or Apache. Aikido says neither unpacks Brotli by default. Compressing pages for visitors isn't the risky part. Unpacking data from somewhere else is.

What to do this week

1. Install your system updates. On Debian and Ubuntu:

sudo apt update && sudo apt upgrade

Debian's security tracker lists the fixed package as 1.0.9-2+deb12u1 for Debian 12 and 1.1.0-2+deb13u1 for Debian 13. You can check what you've got with:

apt-cache policy libbrotli1

When I checked Ubuntu's CVE page on 25 October, every release was still listed as "Needs evaluation", with no fixed version. If you're on Ubuntu, keep an eye on it and install the update when it lands.

2. Restart whatever uses the library. Like PHP and Node, a running program keeps the old code in memory until it restarts. This lists the processes that have Brotli loaded right now:

sudo grep -l libbrotli /proc/*/maps

The numbers in the output are process IDs. Restart those services, or just reboot the server if that's easier.

3. Check your Python apps. In each app's virtual environment:

pip show brotli brotlicffi

If either shows a version below 1.2.1, upgrade it, update your requirements or lock file so it doesn't drift back, and restart the app. With Docker, check inside the container, because it has its own copy:

docker exec <container-name> pip show brotli brotlicffi

If it's your own app, rebuild the image. If it's someone else's tool, pull their latest image once it's out and recreate the container.

4. Don't forget the less obvious places. Bun, Envoy and Istio all have fixed releases too, according to Aikido. If you've got any of those running, update them.

If you can't update straight away

Aikido suggests a stopgap for Python apps where Brotli is optional: uninstall brotli and brotlicffi, so nothing tries to unpack it. The catch is that a server which sends Brotli anyway could cause errors. It's a short-term fix, not a substitute for the update.

The bigger point

This is a flaw in a part nobody thinks about. Most people know they run WordPress or a Python app. Very few know which compression library sits underneath it.

That's not a reason to panic. It's a reason to have someone who knows what's on each server and can answer the question "are we affected?" in an hour, not a week. If nobody in your business is going to do that, that's what a support retainer is for. I keep your servers updated, restart what needs restarting, and tell you about it in plain English.