Brotli Decoder Flaw CVE-2026-111497 Spreads RCE Risk to Python, Bun, and Envoy
A memory-corruption bug in Google's Brotli decoder, tracked as CVE-2026-111497, enables remote code execution in Node.js, Bun, Python, and Envoy. Imperva demonstrated exploitation on Node.js 24.22.0, while OpenAI reported the flaw. Fixes are available, but no active exploitation has been reported.