Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially

The Hacker Newsで読む

2026/10/24 17:45、The Hacker Newsが「Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software」を公開しました (種別: セキュリティニュース)。関連する技術: JavaScript / Node.js、Python。CVE: CVE-2026-111497。