Brotli decoder flaw CVE-2026-111497 reaches Node.js, Bun and Python packages

Each affected project ships its own copy of the decoder, so every runtime and library needs its own update before the fix takes effect.

A memory-corruption bug in Google's Brotli decompression code, tracked as CVE-2026-111497, can let crafted compressed input overwrite memory past a buffer's end, with outcomes ranging from crashes to attacker-controlled code execution. Because each downstream program bundles its own copy of the decoder, Bun, Node.js, Envoy, Istio and several Python packages each need their own update. Imperva showed code execution on one unpatched Node.js 24.22.0 build, though that exploit has not been published and was not tested on other builds. No in-the-wild attacks have been reported, and Google rates the flaw 9.2 critical while Red Hat scores it 8.1. The underlying fix reached Brotli's source in February but no release carried it until October 21, so the practical remedy is updating the affected runtime or library and restarting services.