news
The Hacker News
October 24th, 2026 at 11:09 AMBrotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory,
Get stories like this every Monday
The week's most important AI news in one email. Free, unsubscribe anytime.
Score: 2.17
Engagement proxy: 0
Canonical link: https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html