A vulnerability in Google’s Brotli decoder affects multiple widely-used software programs, including Node.js, Bun, Python packages, Envoy proxies, and Istio. Identified as CVE-2026-111497, the flaw permits malicious compressed data to overwrite memory buffers, potentially causing crashes, memory leaks, or execution of attacker code. Researchers demonstrated remote code execution on an unpatched Node.js build, though no active exploitation has been reported and proof-of-concept code remains unreleased.
The vulnerability was initially fixed in Brotli’s source code in February but went unrecognized as a security issue until disclosure on October 21, when Google and various software vendors released patches. Because each program maintains its own copy of the Brotli decoder, individual updates are required. Users should upgrade to patched versions and restart affected services, or implement temporary safeguards such as rejecting Brotli-compressed requests or disabling automatic decompression in HTTP clients where immediate patching is not possible.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
