Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory corruption vulnerability (CVE-2026-111497) in Google's widely embedded Brotli decoder library demonstrates the cascading risk of shared open-source dependencies: a single flaw in one library can simultaneously expose dozens of downstream runtimes and frameworks to remote code execution. The vulnerability is triggered by maliciously crafted compressed data, meaning any internet-facing application that decompresses user-supplied Brotli data is potentially at risk without requiring authentication. This highlights the critical importance of maintaining a software bill of materials (SBOM) so organisations know immediately which systems are affected when a transitive dependency is compromised. The breadth of impact — spanning Node.js, Bun, Python packages, and Envoy proxies — underscores how supply-chain awareness and rapid patch deployment are essential, not optional, disciplines.