GoKawiilCritical buffer overflow found in Google's Brotli decoder, affecting Node.js and Python
Security researchers disclosed a flaw in Brotli decoder versions 1.0.3 through 1.2.0 that lets maliciously crafted compressed data trigger an out-of-bounds write, potentially causing crashes, memory leaks, or remote code execution. The bug, rated 9.2 Critical by GitHub, affects any software built on Google's C decoder, including Node.js's built-in fetch and zlib bindings, Python's requests and aiohttp libraries, and frameworks like Express and body-parser that decompress Brotli-encoded data.
GoKawiil's interpretation of the reporting above, not reported fact.
Because HTTP clients and web frameworks routinely decompress Brotli-encoded responses or request bodies automatically, the vulnerability could be triggered by any remote server or client sending crafted data through webhooks, uploads, or API calls, without the developer explicitly calling a decompression function. Patching dependencies like Express or body-parser won't fix the underlying issue since the flaw lives in the Brotli decoder itself, meaning organizations must update the core library and restart or redeploy every running process and container to fully close the hole.
- Brotli decoder versions 1.0.3–1.2.0 contain a critical out-of-bounds write bug rated 9.2 CVSS.
- Node.js, Python, and any software using Google's C Brotli decoder are affected, including built-in fetch and common HTTP libraries.
- Simply updating packages isn't enough—running processes and containers retain the vulnerable decoder until restarted or rebuilt on a patched base.
Source: broccoli2shell.com, 2026-10-24
Published there as: “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.