--- title: Brotli Decoder Flaw Reaches Beyond Node.js to .NET and FFmpeg description: Researchers crashed ClickHouse with one request and stalled Apache Arrow using a Google Brotli bug first patched in Node.js; other fixes lag. canonical_url: https://codekeeper.co/ticker/nodejs-vulnerability-brotli-decoder-impact --- [Software security](https://codekeeper.co/ticker/tag/software-security) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities) # Brotli Decoder Flaw Reaches Beyond Node.js to .NET and FFmpeg Researchers crashed ClickHouse with one request and stalled Apache Arrow using a Google Brotli bug first patched in Node.js; other fixes lag. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team Oct 26, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . A vulnerability originally flagged in Node.js turns out to be much broader. CVE-2026-111497 lives inside Google’s Brotli decoder, and JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan have shown it can crash or corrupt .NET apps, FFmpeg, ClickHouse servers, and Apache Arrow workloads. The flaw affects Brotli 1.0.3 through 1.2.0 and is fixed in 1.0.10, 1.1.1, and 1.2.1. An invalid block switch tricks the decoder into continuing with broken state, enabling out-of-bounds memory writes. ClickHouse crashed on a single crafted HTTP request. Apache Arrow entered an infinite CPU loop. FFmpeg corrupted memory via a malicious JPEG XL file, though the researchers stopped short of a full remote code execution exploit. Node.js patches shipped October 21, and Microsoft began rolling out .NET updates on October 25. When the research was published, ClickHouse had merged a fix without shipping a release, and Arrow’s issue was still open. Teams should audit any code path that decompresses untrusted Brotli data — version numbers alone won’t tell the full story, because projects can patch Brotli without changing versions. Source: [Cybersecurity News](https://cybersecuritynews.com/http2shell-vulnerability/) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnodejs-vulnerability-brotli-decoder-impact%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [Data Breach Hits 3 Million Texas Hunting and Fishing License Holders Aug 12, 2026](https://codekeeper.co/ticker/texas-credit-monitoring-after-data-breach) [Coordinated Cyberattack Hits 30+ Minnesota Water Utilities Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack-july-2023) [North Korea's Lazarus Group Exploits Windows Kernel Zero-Day to Deploy Upgraded Rootkit Aug 12, 2026](https://codekeeper.co/ticker/north-korea-lazarus-zero-day-exploit) [Cyberattacks Arizona Court System Cyberattack Exposes Data on 1.3 Million People Oct 8, 2026](https://codekeeper.co/ticker/arizona-court-cyberattack-exposes-personal-data)