Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Summary
A memory corruption vulnerability, tracked as CVE-2026-111497, has been discovered in Google's Brotli decoder. This flaw affects numerous widely used software programs that handle Brotli-compressed data, including Bun, Python's Brotli and brotlicffi packages, and Envoy proxies configured for Brotli decompression. The vulnerability allows specially crafted compressed data to overwrite buffer boundaries, leading to memory corruption.
IFF Assessment
The vulnerability allows for memory corruption, which can be leveraged by attackers to gain unauthorized control over affected systems.
Severity
This vulnerability allows for remote code execution (RCE) due to memory corruption. It has a high attack vector (likely network-based), is relatively easy to exploit (exploitable), and has a significant impact on confidentiality, integrity, and availability. Therefore, a CVSS score of 8.0 is estimated.
Defender Context
This vulnerability in the Brotli decompression library poses a significant risk across a wide range of popular software. Defenders should prioritize patching affected systems and monitor for any exploitation attempts, particularly targeting services that process Brotli-compressed data. Understanding the attack vector, which involves crafted compressed data, is crucial for incident response.