{"id":183985,"date":"2026-10-24T23:40:31","date_gmt":"2026-10-24T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/kriticheskaya-uyazvimost-v-dekodirovshhike-brotli-zatragivayushhaya-node-js-bun-brauzery-http-klienty-i-drugie-proekty"},"modified":"2026-10-24T23:40:36","modified_gmt":"2026-10-24T21:40:36","slug":"critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","title":{"rendered":"Critical vulnerability in the Brotli decoder affecting Node.JS, Bun, browsers, HTTP clients, and other projects","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the reference implementation of the Brotli data compression format decoder (CVE-2026-111497, codenamed Broccoli2Shell and HTTP2Shell), leading to a buffer overflow when processing specially crafted compressed data. According to Google, this vulnerability can be exploited for remote code execution attacks on projects using the official Brotli decoder implementation. Affected projects include: Node.js, Bun, Envoy, Istio, web browsers, proxy servers, HTTP clients, HTTP servers, archivers, UEFI firmware, JPEG XL viewers, content decoding libraries for Python, Ruby, Java, PHP, and .NET, along with their associated dependencies. <\/p>\n
The issue was discovered by OpenAI in February of this year and has been blocked in the Brotli codebase by discarding invalid streams during decoding. On October 22, patches Brotli 1.0.10, 1.1.1, and 1.2.1 were released explicitly stating the vulnerability had been fixed and the core issue addressed. On the same day, a prototype exploit was created that allowed remote code execution in laboratory settings using non-standard builds (standard builds crashed). Later, Imperva observed an attack on the standard Node.js 24.22.0 builds in a Linux environment on the ARM64 system.<\/p>\n
The vulnerability leads to out-of-bounds writes due to improper error handling when parsing blocks in the compressed stream. The DecodeBlockTypeAndLength() function only returned true or false instead of an error code, preventing the calling code from distinguishing between a stream corruption and a state requiring additional data to be passed to the function. When an incorrect block type of compressed data was indicated in the stream, the decoder did not perceive it as an error but rather as a state of insufficient data requiring further reads from the stream. However, since the allocated buffer was not sized for the additionally read data, they were written outside its bounds, where the internal state of the decoder was stored.<\/p>\n
Projects vulnerable to the exploit include:<\/p>\n
\n
The reference Brotli library manifests this problem starting from release 1.0.3 and has been fixed in updates 1.0.10, 1.1.1, and 1.2.1. The vulnerability affects applications and libraries using the libbrotlidec library.\n
The JavaScript platform Node.js has fixed the issue in updates 26.12.1, 24.22.1, and 22.23.4. Applications that use the fetch() method to request third-party content may be attacked, as it automatically decodes HTTP responses with the header 'Content-Encoding: br'. The vulnerability also manifests when directly calling the methods zlib.brotliDecompress*(), createBrotliDecompress(), and brotli.decompress() to unpack third-party content or when handling HTTP requests parsed through Express 5 and body-parser 2.x libraries.\n
Python packages brotli and brotlicffi (a fix was proposed in version 1.2.1), along with projects that use them, including popular libraries urllib3, aiohttp, httpx, and Scrapy, decode responses with the header 'Content-Encoding: br' when accessing external web resources.\n
HTTP servers, HTTP proxies, HTTP clients, and web browsers that support Brotli compression ('Accept-Encoding: br'). Apache httpd comes with mod_brotli (disabled by default). For nginx, there is a third-party module ngx_brotli (the brotli version in dependencies has been updated to the latest). The issue in Chrome\/Chromium and Firefox has already been resolved in one of the previous updates. In the proxy-server<\/a> Envoy vulnerability has been fixed in releases 1.40.0, 1.39.3, 1.38.6, 1.37.8, and 1.36.12.\n