← All stories

Threat intel

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

By The Hacker News1 min read

A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, affects a range of software that unpacks Brotli-compressed data, including Bun, Python's Brotli and brotlicffi packages, and Envoy proxies, The Hacker News reports. Specially crafted compressed data can overwrite past a buffer's end and corrupt memory, and the flaw was previously linked to remote code execution in Node.js.

Cover for a threat-intel story

A memory-corruption vulnerability in Google's Brotli decompression library is present in a wide range of widely used software that unpacks Brotli-compressed data, The Hacker News reports. The flaw is tracked as CVE-2026-111497.

According to the report, the affected software includes the Bun JavaScript runtime, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. The same underlying flaw was previously linked to a remote code execution issue in Node.js.

Per The Hacker News, the vulnerability can be triggered by specially crafted compressed data. When a vulnerable program processes such input, it can write past the end of a buffer and corrupt the program's memory. That kind of memory corruption can potentially be leveraged to alter a program's behavior, including — as demonstrated by the earlier Node.js case — remote code execution.

The report highlights a recurring supply-chain concern in software security: because a single decompression library is embedded across many languages, runtimes and network infrastructure, one defect in that shared component can expose numerous otherwise unrelated products at once. Compression and decompression code is a frequent target for this class of bug, since it routinely handles attacker-controlled input and performs complex buffer operations.

Specific affected versions, patches or mitigation steps were not detailed in the source item. Further technical details are available in The Hacker News' coverage of CVE-2026-111497.

Source: The Hacker News

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.