Security
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
The Hacker News·October 24, 2026·1 min read
A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, affects Bun, Python's Brotli and brotlicffi packages, and Envoy proxies that decompress Brotli data. Crafted compressed data can overwrite past a buffer's end, corrupting memory and potentially enabling remote code execution, as seen in Node.js.
Read at The Hacker NewsDaily crypto arcade
Read the news, then play it.
Chainshorts turns crypto headlines into a daily game. Catch up in 60 words, then jump into daily lucky draws for a shot at the pot.