All articles tagged with #nodejs security
A memory-corruption bug in Google's Brotli decoder, tracked as CVE-2026-111497, enables remote code execution in Node.js, Bun, Python, and Envoy. Imperva demonstrated exploitation on Node.js 24.22.0, while OpenAI reported the flaw. Fixes are available, but no active exploitation has been reported.
A critical vulnerability in the Google Brotli decoder, identified as CVE-2026-111497, allows attackers to corrupt memory and execute remote code by sending crafted compressed data. The flaw affects widely used software including Node.js, Bun, Envoy, and Istio. Fixes are now available for all major affected versions. Organizations unable to patch immediately should disable Brotli decompression for untrusted data to prevent exploitation. The vulnerability impacts any application processing attacker-controlled Brotli-compressed inputs, including HTTP requests, fetched responses, and file processing.