# Brotli flaw extends beyond Node.js to Python and other HTTP software

_Published Saturday, October 24, 2026 at 10:18 PM EDT · Security · Latest · Tier 1 — Major_

![Brotli flaw extends beyond Node.js to Python and other HTTP software — Primary](https://cdn.prod.website-files.com/642adcaf364024654c71df23/6adbe4dc7746ea7df4365811_Node-JS_OG.jpg)

A critical Brotli decompression flaw affects Python packages and other HTTP software beyond Node.js, security company Aikido reported on October 23. Crafted compressed data can corrupt memory, leak information, crash a process or potentially execute code. Both clients accepting malicious responses and servers decoding malicious requests can be exposed.

Patches include Brotli 1.2.1 and brotlicffi 1.2.1.0, alongside fixes for multiple runtimes and proxies. Applications bundling vulnerable copies need rebuilt releases. Aikido said advisory databases had not yet mapped the flaw to the Python packages, leaving pip-audit, Dependabot and Safety unable to flag them.

## Sources

- [aikido.dev](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)

---
Canonical: https://techandbusiness.org/newswire/yoNpscLUcp2ReTdUs5q3gX
Published: 2026-10-25T02:18:58.761Z
Story chronology: 2026-10-23T04:00:00.000Z
Retrieved: 2026-10-25T06:17:50.460Z
Publisher: Tech & Business (techandbusiness.org)