Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

The Hacker News · Saturday, 24 October 2026 at 11:09 (2h ago) · Original article ↗

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.

Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially

You're reading a preview. The full article is published by The Hacker News on their website.

Read the full story on The Hacker News

Dev

Raspberry Pi Desktop proves old PCs aren't past it

Debian 13-based refresh runs comfortably on veteran ThinkPads, without making installation a hobby

The Register 2h ago

Dev

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed…

The Hacker News 2h ago

Dev

Google’s Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM

Google has made Data Agent Kit generally available, a free set of MCP tools and 37 open-source skills that connect coding agents to more than fifteen Google Data Cloud services. Two kinds of guardrail ship with it, and practitioners need to tell them apart: one is a skill asking…

InfoQ 4h ago

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

More Software & Development

Raspberry Pi Desktop proves old PCs aren't past it

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

Google’s Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM