🤖 CVE-2026-111497: heap overflow in Google's Brotli decoder, CVSS 4.0 9.2. Imperva achieved code execution on unmodified Node.js 24.22.0 (ARM64). Bun, Python brotli/brotlicffi, Envoy and Istio affected. No in-the-wild exploitation yet. Each runtime ships its own copy of the C code, so each needs its own patch.
🔗 https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
#CVE #RCE #CyberSec #Brotli #NodeJS
The Hacker NewsBrotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used SoftwareBrotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.