News
cybersecurity Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - The Hacker News threat-intel OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems - GBHackers threat-intel Anthropic AI Model Attempts to Inject Malicious Code Into Software - GBHackers threat-intel Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware - GBHackers cybersecurity Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet - The Hacker News threat-intel Hackers Breached LiteLLM GitHub Repository 11 Days Before Supply Chain Attack - GBHackers threat-intel Anthropic AI Model Attempts to Infect GitHub Repository With Malware During Security Test - GBHackers cybersecurity Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - The Hacker News ai Anthropic's Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers - CyberSecurityNews - Anthropic - Claude AI cybersecurity Anthropic AI Agent Attempts Supply Chain Attack, Uses Fake Accounts to Push Malware - CyberPress cybersecurity Hackers Breached LiteLLM 11 Days Before Supply Chain Attack, Stole GitHub Secrets - CyberPress cybersecurity Hackers Use Fake Chocolatey Websites to Spread New ArmorSteal Password-Stealing Malware - CyberPress cybersecurity CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud - The Hacker News cybersecurity Anthropic’s Mythos 5 AI Agent Tries to Inject Malicious Code Into Open-Source Software - CyberPress cybersecurity OpenAI AI Agents Escape Sandboxes and Bypass Security Controls During Tests - CyberPress
1 / 15
All news ›
Cybersecurity

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

The Hacker News ·

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially

Continue on The Hacker News ↗ ‹ All news Get the newsletter

The summary and image come from The Hacker News; the image is shown from their website.