The recently publicised high severity vulnerability in a popular Google-developed compression library reaches well beyond the open source Node.js JavaScript runtime, an Australian security researcher has found.
Paul McCarty, co-founder and chief technology officer of OpenSourceMalware, investigated developer tools and libraries across several software ecosystems that implement or incorporate Google’s Brotli decompression, looking for exposure to the underlying vulnerability.
He identified a range of potentially vulnerable software, spanning several commonly used open source developer ecosystems such as Python, Go, .NET, Perl and more.
McCarty has nicknamed the flaw the Brotlipocalypse, and said it reminded OpenSourceMalware of the earlier, serious Log4j logging utility that was widely used in software and hardware.
“This vulnerability reminds us of that [Log4j] experience,” McCarty wrote.
“We hope this isn’t going to be as disruptive, but the reality is that Brotli, like Log4j, is used everywhere.
“And, in our testing, its relatively easy to at least get denial of service, if not RCE,” he added.
The flaw has turned up in software beyond the developer tools McCarty set out to check.
Web browsers Chrome and Firefox have picked up the fix by updating their bundled copies of Brotli, McCarty said.
Desktop apps built on the Electron framework, such as Signal, Slack, Discord and Microsoft’s Visual Studio Code, each carry their own copy of the browser engine, and rely on their own update mechanisms for fixes.
Likewise, McCarty said Microsoft’s .NET runtime, the DuckDB database, and the Pillow and pyarrow Python libraries all carry their own copies of the Brotli decoder.
McCarty said the Envoy proxy, widely used in cloud infrastructure, and Unity’s fork of the Mono runtime, which underpins its game engine, have also been fixed.
Fix available in February, but not included in official version
As it happens, the fixed Brotli could’ve reached users much earlier.
Google engineer Evgenii Kliuchnikov added a fix in February this year, describing it only as a change to “detect and report invalid stream earlier”, with no mention of security.
Because the fix was not included in an official version of Brotli until October, software that built on unpatched versions of the Brotli libraries kept shipping the vulnerable decoder until then.
The vulnerability rated as 9.2 out of 10.0 in terms of severity on the CVSS 4.0 scale.
Tracked as CVE-2026-111497, the vulnerability is an out-of-bounds memory write in the Brotli decoder that can corrupt memory and potentially allow remote code execution.
The Node.js runtime disclosed the vulnerability on October 21 and its advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting the flaw, and Matteo Collina and Antoine du Hamel for the fix.
