Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder affects several programs that handle Brotli-compressed data. These programs include Bun, Python Brotli and brotlicffi packages, and Envoy proxies configured for Brotli decompression. The flaw, tracked as CVE-2026-111497, can be exploited using crafted compressed data to overwrite a buffer and corrupt a program's memory. This corruption can potentially lead to remote code execution. The issue is related to a previously identified vulnerability in Node.js. The affected software packages are widely used, indicating a broad potential impact.