Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Posted: Sat Oct 24, 2026 10:44 pm
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.
Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.
Full Article can be found at:
https://thehackernews.com/2026/10/brotl ... s-rce.html
Published Date: Oct 24, 2026
Vulnerabilities has been mentioned in this article:
CVE-2026-111497
Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.
Full Article can be found at:
https://thehackernews.com/2026/10/brotl ... s-rce.html
Published Date: Oct 24, 2026
Vulnerabilities has been mentioned in this article:
CVE-2026-111497