Brotli decoder flaw behind Node.js RCE also hits Bun, Python and Envoy
A buffer overflow in Google's Brotli decoder lets crafted compressed data corrupt memory, and the affected code ships inside many programs that unpack Brotli streams.
A memory-corruption flaw in Google's Brotli decoder sits inside a long list of programs that unpack Brotli-compressed data, not just Node.js. The Hacker News reported on Oct 24, 2026 that the bug also affects Bun, the Python Brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli.
Tracked as CVE-2026-111497, the flaw lets crafted compressed data overwrite past the end of a buffer and corrupt a program's memory. The CNA description says a remote, unauthenticated attacker could use a crafted Brotli-compressed stream to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. Google's CVSS 4.0 score is 9.2, critical.
The CNA lists Brotli versions 1.0.3 through 1.2.0 as affected and points users to 1.0.10, 1.1.1 or 1.2.1. The Node.js project's advisory page is cited as a patch reference. The retained source does not say whether exploits exist in the wild.
Why it matters: decoder libraries are often pulled in indirectly, so teams may run the vulnerable code without knowing it. Defenders should inventory Brotli dependencies, including language packages and proxies that decompress on the fly, and move to the fixed releases the CNA names.
CVE references
Sources
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used SoftwarePrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning