[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7oT3GC9mr9FRQDdkT2WGwFiDJd0K-RmgYYEjtzELl7g":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3e1a6614-0227-4c47-85d5-10c4e2702e9c","Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software","brotli-decoder-flaw-behind-node-js-rce-also-affects-bun-python-and-other-widely-a64123","A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially","A memory corruption vulnerability, CVE-2026-111497, has been discovered in Google's Brotli decoder. This flaw affects numerous widely-used software programs that utilize Brotli compression for data decompression, including Node.js, Bun, Python's Brotli and brotlicffi packages, and Envoy proxies. The vulnerability can be triggered by specially crafted compressed data, leading to buffer overflows and memory corruption, which could result in remote code execution.","Brotli decoder flaw (CVE-2026-111497) causes memory corruption in Node.js, Bun, Python, and Envoy.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fbrotli-decoder-flaw-behind-nodejs-rce.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgxIIerJT3LOMCGn3nXAnmhaHzJlJnVJCso1COluq8t3WuF4IpNARa_Asl5nEhRUDTEcR89kwzo5vGmP5IyNbj1ncdaCpkhqcHUODHAd3khanaE-7N8Vb0NyEJkmPmNkhSpJtLCLgi9srDRhZLtM5n8UDI58F797ZJaVzC7JzjPLfca4NpxZr_7tCX8RIk\u002Fs1600\u002Fbr-nodejs.jpg","2026-10-24T08:45:56+00:00","2026-10-24T11:00:10.153905+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Brotli","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":19},"Node.js",{"name":26,"type":19},"Bun",{"name":28,"type":19},"Python",{"name":30,"type":19},"Envoy","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-111497","Brotli decoder memory corruption vulnerability",[21,18,24],{"controls":61,"vendors":144},[62,91,116],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,100,108],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":92,"product_name":97,"url":98,"description":99},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":117,"name":118,"problem":119,"products":120},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":138,"vendor_name":21,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[145],{"slug":138,"name":21,"logo_path":139,"roles":146},[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"brotli-decoder-memory-flaw-exposes-nodejs-python-and-more-to-rce","Brotli Decoder Memory Flaw Exposes Node.js, Python, and More to RCE","A memory corruption vulnerability (CVE-2026-111497) in Google's widely embedded Brotli decoder library demonstrates the cascading risk of shared open-source dependencies: a single flaw in one library can simultaneously expose dozens of downstream runtimes and frameworks to remote code execution. The vulnerability is triggered by maliciously crafted compressed data, meaning any internet-facing application that decompresses user-supplied Brotli data is potentially at risk without requiring authentication. This highlights the critical importance of maintaining a software bill of materials (SBOM) so organisations know immediately which systems are affected when a transitive dependency is compromised. The breadth of impact — spanning Node.js, Bun, Python packages, and Envoy proxies — underscores how supply-chain awareness and rapid patch deployment are essential, not optional, disciplines.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":161,"PCI DSS Requirement 6":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 requires essential and important entities to implement policies on vulnerability handling and coordinated disclosure; the multi-ecosystem scope of this flaw demands exactly the kind of supply-chain vulnerability governance NIS2 mandates.","PCI DSS Requirement 6 mandates that organisations develop and maintain secure systems by applying security patches promptly; any payment-processing environment running Node.js or Envoy would be directly implicated by this RCE vulnerability.","SI-2 requires organisations to identify, report, and correct information system flaws; having a flaw remediation process with defined timelines would have driven immediate patching of the Brotli decoder across all affected platforms.","This incident is a textbook example of A06: a widely-embedded third-party library with a critical flaw puts every application that includes it at risk if component inventories and update processes are not maintained.","Continuous vulnerability scanning and a defined remediation timeline would have surfaced CVE-2026-111497 across all affected systems immediately upon publication, enabling rapid patching before exploitation.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in software in use, which directly applies to tracking and patching the Brotli library dependency across the organisation's software estate.","While primarily an access control control, ensuring that services processing untrusted Brotli-compressed data operate under least-privilege principles limits the blast radius of a successful memory-corruption exploit leading to RCE."]