Critical Brotli Decoder Flaw Leads to Remote Code Execution in Node.js, Bun, and Python

A memory safety defect in the Brotli decoder, which decompresses data, has been identified as the root cause of a remote code execution (RCE) vulnerability in Node.js and other widely used software like Bun and Python. This high-risk flaw is particularly dangerous because the decoder is often pulled in as a transitive dependency, making it difficult for developers to detect exposure. Successful exploitation can lead to arbitrary code execution with the privileges of the service account. Immediate patching of the Brotli decoder and rebuilding/redeploying affected runtimes are recommended.