9 people reported

All time, since Oct 21, including 8 thumbs-up on GitHub.

Brotli decoder missing CVE fix

Reached by default from fetch() on any Content-Encoding: br response, plus node:zlib and DecompressionStream("brotli").

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/bun/issues/20439/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Brotli decoder lacks CVE-2026-111497 out-of-bounds write fix.

Is this your bug?

Where: Brotli decoder
Versions: 1.3.14
How bad: Security risk: something exposed, or done without permission.

Original reports1, newest first

Oct 21, 2026Brotli decoder is missing the CVE-2026-111497 fix (google/brotli@0ed4268a)#46352

Do you work on Bun?

Claim its RAP Sheet to see what your users report and answer them in one place.