Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially

在 The Hacker News 阅读

2026/10/24 17:45，The Hacker News 发布了“Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software”（类型：安全新闻）。相关技术：JavaScript / Node.js、Python。CVE：CVE-2026-111497。