A memory-corruption vulnerability (CVE-2026-111497) in Google’s Brotli decoder has been found to impact numerous applications that process Brotli-compressed data, including Node.js, Bun, Python’s Brotli packages, and Envoy proxies. This flaw allows specially crafted compressed data to cause an out-of-bounds write, leading to memory corruption and potential remote code execution. Node.js has released security updates, and other affected projects are urged to address the issue promptly.