Applications running Bun >= 1.0.21, < 1.4.4 are affected by a memory-write vulnerability in the bundled Google Brotli decoder. Bun’s remedy is to install 1.4.4 and rebuild executables produced with bun build --compile: those binaries contain their own runtime, so updating the installed Bun version alone does not repair them.
The flaw, CVE-2026-111497, has also drawn reported exploitation attempts. In its October 28 report, Security Affairs said Previdian had recorded one attempt by October 27 and ELLIO researchers had observed traffic containing a public exploit capable of executing code on vulnerable systems. The extent of that activity remains uncertain, and the observations do not demonstrate that attackers successfully exploited Bun.
When Bun reaches the vulnerable decoder
Bun’s advisory, published October 23, identifies an out-of-bounds write in the Brotli library: decoding attacker-controlled compressed data can cause writes outside the intended memory buffer. It lists Brotli 1.0.3 through 1.2.0 as affected, with two exceptions: fixed releases 1.0.10 and 1.1.1. Bun 1.4.3 contains Brotli 1.2.0; Bun 1.4.4 moves to the repaired 1.2.1.
An application does not need to offer a decompression service for hostile data to reach the library. Bun’s fetch sends Accept-Encoding: gzip, deflate, br, zstd by default, then automatically decodes responses carrying Content-Encoding: br. A malicious server contacted by the application can feed the decoder this way. Someone positioned along the network path can also do so when the connection is unencrypted.
Applications can reach the same decoder through node:zlib, including brotliDecompress, brotliDecompressSync and createBrotliDecompress, or through DecompressionStream with the brotli format. The prerequisite is that attacker-supplied Brotli data reaches an affected interface.
Bun attributes the remote code execution assessment to the Brotli project. Its maintainers say they have not tested an attack against Bun and cannot establish whether the impact matches that in other software. They nevertheless advise treating the vulnerability as a remote code execution risk. The advisory rates it High; that severity assessment is separate from evidence of exploitation.
For deployments awaiting an upgrade, Bun describes limited measures rather than a process-wide workaround. On a particular fetch request, decompress: false suppresses Accept-Encoding: br and disables response decompression. Other calls remain unaffected by that setting. The advisory also instructs applications to keep untrusted data away from the Brotli interfaces in node:zlib and DecompressionStream. With the updated decoder, invalid data produces BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH.
Federal catalog report needs qualification
Security Affairs also reported that CISA had added CVE-2026-111497 and CVE-2026-48356, an unrestricted file upload vulnerability in Adobe Commerce and Magento known as PolyShell, to its Known Exploited Vulnerabilities catalog. It gave October 29, 2026 as the federal remediation deadline.
CISA’s October 26 alert announces different entries: CVE-2026-109618, concerning PHP memory corruption, and CVE-2026-109619, concerning stale internal PHP request state. That announcement does not confirm the reported Brotli or Adobe additions, or the October 29 deadline. CISA cites Binding Operational Directive 26-04, which applies to Federal Civilian Executive Branch agencies, and encourages other organizations to prioritize remediation according to risk.
For PolyShell, Security Affairs relayed Sansec’s finding that attacks had infected at least 953 online stores. The reported mechanism involved a Magento CMS block containing a malicious loader that could fetch and execute an attacker-hosted payload. Researchers had not recovered that subsequent payload, leaving the campaign’s ultimate purpose uncertain. The report described the activity as ongoing and believed to date back to at least July 2025.
