GoKawiilBrotli decoder flaw CVE-2026-111497 spreads beyond Node.js to Python, C++, bun, Envoy
A critical out-of-bounds write vulnerability in Google's Brotli decompression library, first disclosed in Node.js as CVE-2026-111497 on October 21, has been confirmed to affect Python, C++, bun, Envoy and other HTTP-related software. The bug lets an attacker send crafted Brotli-compressed data to corrupt memory, leak data, crash processes or potentially run arbitrary code; patches exist for some affected projects while others are still pending, and Apache and Nginx are not affected by default since they don't decode Brotli.