## Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

- 種別: news
- 関連技術: nodejs, python
- CVE: CVE-2026-111497
- 公開日時: 2026-10-24T08:45:56.000Z
- 情報源: The Hacker News (https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html)
- パーマリンク: https://vulnpulse.app/items/thehackernews-a64123d82829

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially