Which software is affected by the Brotli decoder flaw?A memory-corruption bug in Google's Brotli decoder, the same flaw behind a Node.js remote code execution issue, also ships in Bun, the Python brotli and brotlicffi packages, and the Envoy proxy.What happened: Researchers disclosed that the memory-corruption flaw sits in the Brotli decompression code that many programs use to unpack .br data, not just in Node.js. Because the vulnerable decoder is copied into runtimes, language bindings, and service proxies, patching Node.js alone leaves other exposed software untouched. Anyone who feeds attacker-supplied Brotli data into these libraries inherits the risk.Key numbers: At least 5 widely used projects carry the flawed decoder: Node.js, Bun, Python brotli, brotlicffi, and Envoy.Brotli compression is accepted by every major browser for HTTPS content encoding.A single malformed Brotli stream can trigger memory corruption in the decoder path.Why it matters: Decompression bugs are reachable before authentication in proxies and servers, so a crafted request body can crash or compromise a process that never expected to parse untrusted archives.Bottom line: When one decoder library is vendored everywhere, a single memory bug becomes a fleet-wide patch race.