Brotli.

How Does Brotli Work?

The Brotli project describes Brotli as a general-purpose lossless compression algorithm. It combines a modern variant of the LZ77 algorithm, Huffman coding and second-order context modeling. It runs at a speed similar to deflate, but it packs data more densely.

Lossless means that nothing is lost: the receiver gets back exactly the data that was sent. The sender runs an encoder, and the receiver runs a decoder. The decoder is the part that reads data from outside.

Where Is Brotli Used?

Web software can label a message as Brotli with the content encoding br. For example, the Express body-parser library lists br next to gzip, deflate and zstd as encodings it can decode for request bodies. The CVE record for CVE-2026-111497 asks users to update any Brotli libraries or binaries in the affected range, which includes copies bundled inside other software.

The format is a stream. The Brotli project notes that it carries no checksum or length, so a decoder cannot notice if parts of the stream were changed on the way.

Why Does Brotli Matter for Security?

A decoder takes untrusted input and turns it into memory writes. If the decoder has a bug, a crafted stream can corrupt memory. On 21 October 2026, Node.js fixed such a bug in its bundled Brotli decoder. The flaw is CVE-2026-111497, and researchers call it Node2Shell. Read the Node2Shell analysis for fixed versions and checks, or the CVE-2026-111497 fact sheet.

The CVE record places the root bug in Google’s Brotli library, versions 1.0.3 through 1.2.0. Software that bundles that library may need an update too.

How Do You Reduce the Risk?

• Keep libraries that decode compressed data up to date, including copies bundled inside other software.
• Know which of your services decode data from outside, such as request bodies and fetched files.
• Reject encodings you do not need at the proxy or in the framework.
• Run services with low permissions, so a decoder bug gives an attacker less.