Google Brotli decoder flaw affects Node.js, Bun, and Python

A memory-corruption vulnerability in Google’s Brotli decoder, tracked as CVE-2026-111497, has been identified in several widely used software packages. The flaw exists in the C code used to unpack Brotli-compressed data, allowing crafted data to overwrite memory buffers. This can lead to program crashes, memory leaks, or the execution of attacker-controlled code.

Researchers from Imperva demonstrated that the vulnerability could allow remote code execution on certain unpatched Node.js builds. While no real-world attacks have been reported, the flaw impacts a broad range of technologies, including the Bun runtime, Python’s Brotli and brotlicffi packages, and Envoy proxies.

Because many programs ship with their own copies of the Google Brotli decoder, individual developers and organizations must update their specific implementations. Fixes have been released for Node.js, the Brotli C library, Bun, Envoy, Istio, and Python-related packages.