CERT24Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other widely used softwareLoading data…
CERT24Threat Observatory
Period

Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other widely used software

A memory-corruption flaw in Google’s Brotli decoder affects multiple programs that unpack Brotli-compressed data, including Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. Tracked as CVE-2026-111497, the flaw has not been linked to any reported real-world attacks.

← Back to intelligence

Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other widely used software

A memory-corruption flaw in Google’s Brotli decoder affects multiple programs that unpack Brotli-compressed data, including Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli. Tracked as CVE-2026-111497, the flaw has not been linked to any reported real-world attacks.