Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

October 24, 2026 · 8:45 am 1 sources

Image: The Hacker News

Coverage

More coverage

• Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
  The Hacker News · October 24, 2026 08:45
  A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite…