Brotli Decoder Flaw Behind Nodejs RCE Also Affects Bun Python and Other Widely Used Software

A memorycorruption flaw in Googles Brotli decoder sits in many programs that unpack Brotlicompressed data among them Bun the Python Brotli and brotlicffi packages and Envoy proxies set up to decompress Brotli Tracked as CVE2026111497 the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a programs memory potentially