Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

T2Covered by 1 source · first reported by The Hacker News at 24 Oct, 08:45 UTC

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite…