CVE-2026-111497: Brotli Decoder Out-of-Bounds Write Enables RCE Across Multiple Platforms
CVE-2026-111497 is an out-of-bounds write in Brotli’s decoder that can lead to remote code execution. Inventory – Identify all systems that use Brotli.
nodejs
2 stories
Brotli Decoder Memory Corruption Enables RCE in Node.js, Bun, Python and More
CVE-2026-111497 in Google’s Brotli decoder allows crafted data to overwrite memory, enabling RCE in Node.js, Bun, Python and other software.