Overview
- Security teams disclosed a critical out-of-bounds write in the upstream Brotli C decoder that can corrupt memory, leak sensitive data, crash processes, or enable remote code execution when decompressing untrusted Brotli input.
- The bug is downstreamed into many products that bundle or statically link the Brotli decoder, including Node.js, Bun, Envoy, Istio, Python Brotli packages and several Microsoft runtimes, and fixed library releases are available from vendors.
- Researchers have published proof-of-concept exploits and Imperva demonstrated code execution against an unpatched official Node.js Linux arm64 image, which shows exploitability on at least some builds and configurations.
- Effective remediation requires updating the Brotli library or affected product binaries, rebuilding container images and CI artifacts, restarting runtimes and redeploying services so patched code is loaded, and prioritizing internet-facing services that auto-decompress Brotli.
- As a stopgap, vendors and researchers recommend blocking requests with Content-Encoding: br at the edge, monitoring for decompression failures or crashes, and inventorying clouds, containers and embedded devices because the decoder is widely embedded across servers, APIs and IoT stacks.