A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program’s memory, potentially
First seen on thehackernews.com
Jump to article: thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
