- 25th October 2026
One out-of-bounds write in Google’s Brotli decoder, shipped as a private copy inside Node.js, Bun, Python wheels, Envoy, .NET and SBOM tooling. What is fixed, what is not, and why manifest scanners miss most copies.
Sarah Mitchell


















