Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.

Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled data.

IntroductionImperva researchers have demonstrated that crafted Brotli data can be used to execute attacker code in applications running on official Node.js builds. The proof-of-concept (PoC) is named ...