Update: the Brotli RCE now bites Bun, Envoy and Istio too
First it was Node, then Python's HTTP stacks. Now the same Brotli flaw hits Bun and service meshes — plus bundled copies a runtime fix can't touch.
Copy markdown
Bun ≤1.4.3 is on the list now — upgrade to 1.4.4
Bun ships its own copy of the flawed Brotli decoder, so patching Node and Python left it exposed. Versions 1.4.3 and earlier are vulnerable; 1.4.4 fixes it. Run `bun upgrade` and redeploy anything that decompresses `br` input.
Envoy and Istio, but only with Brotli decode on
Both are affected only when their Brotli decompressor is enabled — a setting plenty of service meshes flip on for compressed upstreams. Check your config before assuming the mesh is clear.
Patching your runtime won't save bundled Brotli
The decoder is vendored far beyond Node and Python. The Broccoli2Shell writeup flags .NET, PHP, DuckDB, ClickHouse, Apache Arrow and 7-Zip-zstd among projects carrying their own copy, several still unpatched on Oct 25. A Node or pip upgrade doesn't touch these — track each dependency's own advisory.
9.2 Critical, but no working RCE in the wild
GitHub rates CVE-2026-111497 a 9.2 (CVSS 4.0); CISA's Oct 23 check logged zero in-the-wild exploitation, and Red Hat says there's no reliable public code-exec PoC — only a crash and a limited memory read. Patch on a schedule, not in a panic.
The fix matrix in one line
Node 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, Python `Brotli>=1.2.1` and `brotlicffi>=1.2.1.0`. Then restart every process and rebuild images on patched bases — a fresh install leaves already-running workers vulnerable.