Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A buffer-overflow bug in Google's Brotli decompression library, tracked as CVE-2026-111497, turns out to affect far more than Node.js: Bun, the Python Brotli and brotlicffi packages, Envoy and Istio proxies, and the cdxgen scanner all bundle their own copy of the vulnerable C code and must each ship their own patch. Crafted compressed data can corrupt memory, causing crashes, data leaks, or arbitrary code execution whenever a program decodes untrusted Brotli content, for example via fetch() responses, Express/body-parser uploads, or an installed Python HTTP client. Imperva researchers already achieved remote code execution on an unpatched Node.js 24.22.0 build, though no in-the-wild attacks have been confirmed yet and CISA still rates exploitation as none. Fixes landed on October 21 for Node.js (22.23.4, 24.22.1, 26.12.1) and Brotli itself, with Bun 1.4.4, Envoy, Istio, and the Python packages patched in following days; affected organizations should upgrade, restart services, rebuild containers, and, where patching isn't yet possible, block or disable Brotli decoding of untrusted input.