Out-of-Bounds Write Vulnerability in Google Brotli Decoder · CIAD-2026-0055
CERT-IN advisory CIAD-2026-0055 · 27 Oct 2026
Official title
CIAD-2026-0055 : Out-of-Bounds Write Vulnerability in Google Brotli Decoder
Official record
Open source pageSummary
Check the official recordWhat changed
A buffer overflow vulnerability in the Google Brotli decoder versions 1.0.3 through 1.2.0 allows remote attackers to corrupt memory or execute arbitrary code. This vulnerability affects users of Google Brotli, Node.js, Bun, .NET, Envoy, Istio, Python Brotli, Python brotlicffi, Cdxgen, and PHP. Attackers use a crafted Brotli-compressed stream to trigger the vulnerability. Users must apply the security updates provided by their respective software vendors to mitigate the risk of system compromise and denial of service.
What you must do
- Apply the security updates provided by the respective software vendors.
Key dates
- Original Issue Date
- 27 Oct 2026
Who is affected
Document text
CERT-In Advisory CIAD-2026-0055
Out-of-Bounds Write Vulnerability in Google Brotli Decoder
Original Issue Date: October 27, 2026
Severity Rating: Critical
Systems Affected
Google Brotli (C library) Node.js Bun .NET Envoy Istio Python Brotli Python brotlicffi Cdxgen PHP
Overview
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Target Audience: Individuals and organizations using software that utilizes the Brotli decoder, including those using Bun, Microsoft .NET, Python (Brotli and brotlicffi packages), and Envoy proxies.
Risk Assessment: Critical risks of unauthorised access, memory corruption and denial of service.
Impact Assessment: Potential for arbitrary code execution, system compromise, sensitive data disclosure, memory corruption, and denial of service.
Description
An Out-of-Bounds Write vulnerability has been reported in using products that utilizes the Brotli decoder; details of which are provided below:
Solution
Apply appropriate updates as mentioned by the vendor:
https://github.com/google/brotli/releases https://nodejs.org/en/blog/vulnerability/october-2026-security-releases https://github.com/oven-sh/bun/releases/tag/bun-v1.4.4 https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9 https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr https://istio.io/latest/news/security/istio-security-2026-007/ https://github.com/pypa/advisory-database/blob/main/vulns/brotli/PYSEC-2026-4322.yaml https://github.com/pypa/advisory-database/blob/main/vulns/brotlicffi/PYSEC-2026-4323.yaml https://github.com/cdxgen/cdxgen/security/advisories/GHSA-5266-jm88-3grm https://www.php.net/archive/2026.php#2026-10-26-1
References
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
CVE Name
CVE-2026-111497
Source details
- Source
- cert-in
- Type
- advisory
- Published by source
- 27 Oct 2026
- Document number
- CIAD-2026-0055
- Issuing division
- CERT-In
- Coverage area
- Not available