Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Google's Brotli decoder contains a memory-corruption flaw, tracked as CVE-2026-111497, that allows crafted compressed data to overwrite memory.
- The Bun JavaScript runtime is among the affected programs that unpack Brotli-compressed data.
- Python's Brotli and brotlicffi packages are also vulnerable to this decoder flaw.
- Envoy proxies configured to decompress Brotli data are impacted by this security issue.
Why it matters: The flaw's presence in foundational libraries like Brotli creates a widespread and critical patching challenge for developers and security teams across multiple ecosystems, as a single exploit could target applications built with Node.js, Bun, Python, and Envoy.
Ask SkimNews
