# Node.js and Python Brotli fixes address potential remote code execution

_Published Sunday, October 25, 2026 at 4:18 PM EDT · Security · Latest · Tier 2 — Notable_

![Node.js and Python Brotli fixes address potential remote code execution — Primary](https://assets.st-note.com/production/uploads/images/328465670/rectangle_large_type_2_bb4d0736a22e9df8e14477fffd262219.png?fit=bounds&quality=85&width=1280)

Fixes for a Brotli decompression vulnerability are available for Node.js and Python packages, a technical review on note reports, citing official advisories. CVE-2026-111497 can cause crashes, memory leakage or remote code execution when software decompresses attacker-prepared data.

The decoder mistakes malformed data for incomplete input and continues writing into an internal 8-byte buffer, risking adjacent memory corruption. Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1; Python fixes include Brotli 1.2.1 and brotlicffi 1.2.1.0.

Exposure depends on decompressing hostile Brotli data, including responses received by clients. Updating a computer's Node.js installation does not also update copies bundled inside applications or Docker images.

## Sources

- [note](https://note.com/curegorira35/n/n578e20c42d78?hl=en)

---
Canonical: https://techandbusiness.org/newswire/JJDAGCjoziTG8YamyV9qPO
Published: 2026-10-25T20:18:11.308Z
Story chronology: 2026-10-25T13:39:33.000Z
Retrieved: 2026-10-25T22:58:20.901Z
Publisher: Tech & Business (techandbusiness.org)