Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption vulnerability tracked as CVE-2026-111497 has been discovered in Google's Brotli decoder library. The flaw enables crafted compressed data to overwrite past the end of a buffer, corrupting program memory and potentially enabling remote code execution. The vulnerability is widespread, affecting multiple popular software ecosystems including Node.js, Bun, Python's Brotli and brotlicffi packages, and Envoy proxies configured for Brotli decompression. The breadth of affected software makes this a significant supply chain and dependency risk. Any application that decompresses Brotli-encoded data using the vulnerable decoder is potentially at risk. Patches or mitigations should be applied promptly across all affected platforms.