Critical Brotli Decoder Bug Triggers Remote Code Execution Across Multiple Platforms

A newly disclosed memory‑corruption vulnerability in Google’s Brotli decompression library has been linked to remote code execution (RCE) attacks in a range of popular software, including Node.js, the Bun JavaScript runtime, Python’s Brotli and brotlicffi packages, and Envoy proxy instances that perform on‑the‑fly Brotli decompression.

The flaw, catalogued as CVE‑2026‑111497, arises when the decoder mishandles specially crafted compressed streams, allowing an attacker to corrupt memory and potentially execute arbitrary code on the host. Because Brotli is widely employed for HTTP content compression, the vulnerability can be triggered simply by serving maliciously compressed assets to vulnerable services.

Node.js, which powers countless server‑side JavaScript applications, relies on the Brotli library for its built‑in compression APIs. An exploit could let an attacker compromise a Node.js server that processes untrusted compressed data, such as file uploads or API payloads. Similarly, Bun – a newer JavaScript runtime marketed for its speed – integrates the same decoder, extending the risk to projects that have adopted it for performance reasons.

In the Python ecosystem, the official Brotli package and its CFFI‑based counterpart, brotlicffi, are used by many web frameworks and data‑processing tools to handle compressed content. The vulnerability therefore affects a broad swath of Python applications that accept external Brotli streams, from web services to scientific pipelines.

Envoy, a high‑performance edge and service proxy, often terminates TLS and performs on‑the‑fly compression and decompression. Configurations that enable Brotli decompression on inbound traffic are now exposed to the same RCE vector, raising concerns for large‑scale deployments in cloud and micro‑service architectures.

Vendors have begun issuing patches: the Node.js project released a security update that upgrades the bundled Brotli library, Bun announced an upcoming release with the fix, and maintainers of the Python packages have pushed updated wheels. Envoy users are advised to disable Brotli decompression until a patched version is deployed. Security researchers recommend that administrators audit their systems for any services that accept Brotli‑compressed input and apply the relevant updates immediately. The broader community is watching closely, as the flaw underscores the hidden risks in third‑party compression libraries that are often taken for granted.