Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
| CVE | CVE-2026-111497 |
|---|---|
| Source | The Hacker News |
| Fetched | 10/24/2026, 07:18 PM |
| Data | Markdown JSON |
On 10/24/2026, 05:45 PM, The Hacker News published "Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software" (type: Security news). Related technologies: JavaScript / Node.js, Python. CVE: CVE-2026-111497.