Brotli Decoder Vulnerability

The Brotli decoder vulnerability is a cybersecurity threat that affects Node.js, Bun, Python, and Envoy proxies. Cybersecurity is a critical concern in today's digital landscape. A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially allowing remote code execution.

What is the Brotli Decoder Vulnerability?

The Brotli decoder vulnerability is a buffer overflow vulnerability that affects the Brotli decoder, a library used to decompress Brotli-compressed data. This vulnerability can be exploited by an attacker to execute arbitrary code on a vulnerable system. The vulnerability is caused by a memory-corruption flaw in the Brotli decoder, which allows an attacker to overwrite past the end of a buffer and corrupt a program's memory.

How Does the Vulnerability Affect Different Software?

The Brotli decoder vulnerability affects a range of software, including Node.js, Bun, Python, and Envoy proxies. Node.js is a popular JavaScript runtime environment that uses the Brotli decoder to decompress Brotli-compressed data. Bun is a fast and lightweight JavaScript runtime environment that also uses the Brotli decoder. Python is a popular programming language that uses the Brotli decoder to decompress Brotli-compressed data. Envoy proxies are a popular proxy server that uses the Brotli decoder to decompress Brotli-compressed data.

Comparison of Affected Software