GoKawiilCritical buffer overflow found in Google's Brotli decoder, affecting Node.js and Python
Security researchers disclosed a flaw in Brotli decoder versions 1.0.3 through 1.2.0 that lets maliciously crafted compressed data trigger an out-of-bounds write, potentially causing crashes, memory leaks, or remote code execution. The bug, rated 9.2 Critical by GitHub, affects any software built on Google's C decoder, including Node.js's built-in fetch and zlib bindings, Python's requests and aiohttp libraries, and frameworks like Express and body-parser that decompress Brotli-encoded data.