Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
-
A memory-corruption vulnerability in Google's Brotli decoder has a much wider reach than initially thought, extending well beyond the Node.js remote code execution issue that first brought it to attention. The flaw, tracked as CVE-2026-111497, allows specially crafted compressed data to write past the end of a buffer, corrupting the affected program's memory.
Because the decoder is embedded in a broad range of software that unpacks Brotli-compressed data, the exposure is not limited to a single platform. Confirmed affected software includes:
- Bun
- Microsoft .NET
- The Python Brotli and brotlicffi packages
- Envoy proxies configured to decompress Brotli
Any application or service that accepts untrusted Brotli-compressed input and relies on an unpatched decoder should be treated as potentially at risk. Administrators are advised to identify where Brotli decompression is exposed to external input and apply vendor updates as they become available.
Source: The Hacker News
Does your organization rely on any of the affected Brotli implementations, and how are you handling the patch?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login