Brotli Decoder Flaw CVE-2026-111497 Forces Urgent Updates Across Node.js, Bun, and Envoy
A critical vulnerability in the Google Brotli decoder, identified as CVE-2026-111497, allows attackers to corrupt memory and execute remote code by sending crafted compressed data. The flaw affects widely used software including Node.js, Bun, Envoy, and Istio. Fixes are now available for all major affected versions. Organizations unable to patch immediately should disable Brotli decompression for untrusted data to prevent exploitation. The vulnerability impacts any application processing attacker-controlled Brotli-compressed inputs, including HTTP requests, fetched responses, and file processing.