Brotli is a lossless compression format that makes data smaller so it can be stored or sent faster. It is defined in RFC 7932 and used on the web as the content encoding named br. A flaw in a Brotli decoder, CVE-2026-111497, led to the Node2Shell warnings in October 2026.
How Does Brotli Work?
The Brotli project describes Brotli as a general-purpose lossless compression algorithm. It combines a modern variant of the LZ77 algorithm, Huffman coding and second-order context modeling.
It runs at a speed similar to deflate, but it packs data more densely. Lossless means that nothing is lost: the receiver gets back exactly the data that was sent.
The decoder is the part that reads data from outside.
| Brotli fact | Detail |
|---|---|
| Type | Lossless compression format. |
| Specification | RFC 7932, published by the IETF for information. |
| Name on the web | Content encoding br. |
| Building blocks | A modern LZ77 variant, Huffman coding and second-order context modeling. |
| Speed and density | Similar speed to deflate, with denser output. |
| Compared with gzip | Smaller output, but slower to compress. gzip can suit content that is not cached. |
| Integrity check | None in the stream: no checksum and no length. |
| Decoder bug | CVE-2026-111497 in Brotli 1.0.3 through 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1. |
How Is Brotli Different From gzip?
gzip is the older format and is based on the Deflate algorithm. Brotli adds second-order context modeling to LZ77 and Huffman coding. MDN says Brotli gives better compression ratios than gzip, but compresses more slowly.
That trade-off decides where each fits. A script or style sheet is compressed once and cached, so Brotli's smaller output pays off. MDN says gzip may be the better choice for content that is not cacheable.
Both are content encodings. The browser lists the ones it can read in the Accept-Encoding header, for example gzip, deflate, br. The server picks one and names it in Content-Encoding. MDN says Brotli works in most modern browsers and suggests a fallback.
Where Is Brotli Used?
Web software can label a message as Brotli with the content encoding br. For example, the Express body-parser library lists br next to gzip, deflate and zstd as encodings it can decode for request bodies. The CVE record for CVE-2026-111497 asks users to update any Brotli libraries or binaries in the affected range, which includes copies bundled inside other software.
Web servers and content delivery networks send pages, scripts and style sheets as Brotli. Cloudflare says it can return Gzip, Brotli or Zstandard responses, depending on what the visitor's browser supports. For nginx, Google publishes the ngx_brotli module, and Apache has had mod_brotli since version 2.4.26.
How Do You Check That a Site Uses Brotli?
Ask for Brotli and read the reply headers. This command sends Accept-Encoding: br and prints only the headers:
curl -s -D - -o /dev/null -H "Accept-Encoding: br" https://example.com
A content-encoding: br line means the server sent Brotli. If the line is missing, the server used another encoding or none. The Network tab in a browser's developer tools shows the same header.
How Do You Enable Brotli?
On nginx, add Google's ngx_brotli module and set brotli on. Its README gives levels from 0 to 11, with a default of 6.
On Apache, use mod_brotli, which adds the BROTLI_COMPRESS output filter. Its quality runs from 0 to 11, with a default of 5.
On a CDN, check your provider's compression settings. Cloudflare says its Pro and Business plans compress content with Brotli by default.
Higher levels give smaller files but compress more slowly. Apache's documentation says quality 11 only suits content that is cached. For pages built on every request, use a middle level.
Is Brotli Safe? The CVE-2026-111497 Decoder Bug
A decoder takes untrusted input and turns it into memory writes. If the decoder has a bug, a crafted stream can corrupt memory.
On 21 October 2026, Node.js fixed such a bug in its bundled Brotli decoder. The flaw is CVE-2026-111497, and researchers call it Node2Shell. Read the Node2Shell analysis for fixed versions and checks, or the CVE-2026-111497 fact sheet.
The CVE record places the root bug in Google’s Brotli library, versions 1.0.3 through 1.2.0. Software that bundles that library may need an update too.
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a due date of 10 November. The format is not the problem. Copies of the decoder are, so each one needs Brotli 1.0.10, 1.1.1 or 1.2.1, or a vendor package with the fix backported. Our HTTP2Shell guide lists fixed versions by runtime and Linux distribution.
How Do You Reduce the Risk?
Pick a step on the pathAlso Called.
Questions.
It labels a message body as Brotli-compressed. Libraries such as Express body-parser list br next to gzip, deflate and zstd as encodings they can decode.
- 01Brotli README, GitHub (Google Brotli)
- 02RFC 7932, Brotli Compressed Data Format, IETF
- 03body-parser README, Express
- 04CVE-2026-111497 record, CVE Program (Google)
- 05Wednesday, October 21, 2026 Security Releases, Node.js
- 06Brotli compression, MDN
- 07mod_brotli, Apache HTTP Server
- 08ngx_brotli README, GitHub (Google ngx_brotli)
