{"id":183985,"date":"2026-10-24T23:40:31","date_gmt":"2026-10-24T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/kriticheskaya-uyazvimost-v-dekodirovshhike-brotli-zatragivayushhaya-node-js-bun-brauzery-http-klienty-i-drugie-proekty"},"modified":"2026-10-24T23:40:36","modified_gmt":"2026-10-24T21:40:36","slug":"critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","title":{"rendered":"Kriti\u010dna ranjivost u dekoderu Brotli koja utje\u010de na Node.JS, Bun, preglednike, HTTP klijente i druge projekte","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>U biblioteci s referentnom implementacijom dekodera formata kompresije podataka Brotli otkrivena je ranjivost (CVE-2026-111497, kodna imena Broccoli2Shell i HTTP2Shell) koja dovodi do preljevanja bafera prilikom obrade posebno oblikovanih komprimiranih podataka. Prema podacima Googlea, ranjivost se mo\u017ee iskoristiti za daljinsko izvr\u0161avanje koda prilikom napada na projekte koji koriste slu\u017ebenu implementaciju dekodera Brotli. Me\u0111u pogo\u0111enim projektima su: Node.js, Bun, Envoy, Istio, web preglednici, proxy serveri, HTTP klijenti, HTTP serveri, arhivatori, UEFI firmware, preglednici JPEG XL, knji\u017enice za dekodiranje sadr\u017eaja za Python, Ruby, Java, PHP i .NET te povezane ovisnosti. <\/p>\n<p>Problem je otkriven od strane kompanije OpenAI u velja\u010di ove godine i blokiran u kodnoj bazi Brotli odbacivanjem nepravilnih streamova prilikom dekodiranja. 22. listopada objavljene su ispravne verzije Brotli 1.0.10, 1.1.1 i 1.2.1 u kojima je jasno navedeno da je ranjivost ispravljena i su\u0161tina problema rije\u0161ena. Iste je dane stvoren prototip eksploita, koji je omogu\u0107io daljinsko izvr\u0161avanje koda u laboratorijskim uvjetima, koriste\u0107i nestandardne gradnje (u standardnim gradnjama do\u0161lo je do ru\u0161enja). Kasnije je kompanija Imperva zabilje\u017eila napad na standardne gradnje Node.js 24.22.0 u Linux okru\u017eenju na ARM64 sustavu.<\/p>\n<p>Ranjivost dovodi do pisanja izvan bafera zbog nepravilnog rukovanja pogre\u0161kama tijekom analize blokova u komprimiranom streamu. Funkcija DecodeBlockTypeAndLength() umjesto koda pogre\u0161ke vra\u0107ala je samo vrijednosti true i false, \u0161to nije omogu\u0107ilo pozivnom kodu da razlikuje o\u0161te\u0107enje streama od stanja koje zahtijeva prijenos dodatnih podataka u funkciju. U slu\u010daju da je u streamu naveden neispravan tip bloka komprimiranih podataka, dekoder ga je do\u017eivljavao ne kao gre\u0161ku, ve\u0107 kao stanje nedostatka podataka, koje je zahtijevalo dodatno \u010ditanje iz streama. Me\u0111utim, s obzirom na to da je dodijeljeni bafer bio prora\u010dunat bez dodatno pro\u010ditanih podataka, oni su se pisali u podru\u010dje izvan njegovih granica, gdje se \u010duvalo interno stanje dekodera.<\/p>\n<p>Projekti pogo\u0111eni ranjivosti:<\/p>\n<ul>\n<li class=\"l\"> Referentna biblioteka brotli, problem se pojavljuje od izdanja 1.0.3 i ispravljen je u nadogradnjama 1.0.10, 1.1.1 i 1.2.1. Ranjivost utje\u010de na aplikacije i biblioteke koje koriste biblioteku libbrotlidec.\n<li class=\"l\"> JavaScript platforma Node.js, problem je rije\u0161en u a\u017euriranjima 26.12.1, 24.22.1 i 22.23.4. Aplikacije koje koriste metodu fetch() za pozivanje vanjskog sadr\u017eaja mogu biti napadnute, jer automatski dekodiraju HTTP odgovore s zaglavljem 'Content-Encoding: br'. Tako\u0111er, ranjivost se pojavljuje prilikom izravnog pozivanja metoda zlib.brotliDecompress*(), createBrotliDecompress() i brotli.decompress() za raspakiranje vanjskog sadr\u017eaja ili prilikom primanja HTTP zahtjeva s obradom preko biblioteka Express 5 i body-parser 2.x.\n<li class=\"l\"> Python paketi brotli i brotlicffi (ispravka je predlo\u017eena u verziji 1.2.1) i projekti koji ih koriste, me\u0111u kojima su popularne biblioteke urllib3, aiohttp, httpx i Scrapy, koje dekodiraju odgovore s zaglavljem 'Content-Encoding: br' prilikom pristupa vanjskim web resursima.\n<li class=\"l\"> HTTP poslu\u017eitelji, HTTP proxy, HTTP klijenti i web preglednici koji podr\u017eavaju Brotli kompresiju ('Accept-Encoding: br'). U Apache httpd dolazi mod_brotli (koji je prema zadanim postavkama isklju\u010den). Za nginx dostupan je vanjski modul ngx_brotli (verzija brotli u ovisnostima je a\u017eurirana na najnoviju). U Chrome\/Chromium i Firefoxu je problem ve\u0107 rije\u0161en u jednom od ranijih a\u017euriranja. U proxy-<a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/server\/dts-dronten\/\"   title=\"serveru\" data-wpil-keyword-link=\"linked\">serveru<\/a> Envoy vulnerability fixed in releases 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12.\n<li class=\"l\"> .NET runtime when using BrotliDecoder, BrotliStream, and HttpClient methods in the application. The vulnerability is not yet fixed.\n<li class=\"l\"> PHP extension brotli when using the function brotli_uncompress(). The fix is in progress.\n<li class=\"l\"> Ruby package brotli when using the method Brotli.inflate. The vulnerability is not yet fixed.\n<li class=\"l\"> DuckDB database when importing compressed Parquet files. The fix is in progress.\n<li class=\"l\"> ClickHouse database. The fix is in progress.\n<li class=\"l\"> YDB database. The vulnerability is not yet fixed.\n<li class=\"l\"> Apache Arrow when importing compressed Parquet files. The fix is in progress.\n<li class=\"l\"> libjxl (when compressing metadata in JPEG XL, Brotli is used).<br \/>\nThe fix is in progress.<\/p>\n<li class=\"l\"> Archivers NanaZip, 7-Zip-zstd, and p7zip when unpacking br files. The vulnerability is not fixed.\n<li class=\"l\"> MuPDF. The vulnerability is not fixed.\n<li class=\"l\"> UEFI firmware temeljen na EDK II i UEFITool, komprimirani pomo\u0107u Brotli. Ispravka je u procesu pripreme \u2014 EDK II i UEFITool.\n<li class=\"l\"> JavaScript platform Bun. The vulnerability was fixed in version 1.4.4.\n<li class=\"l\"> Platform for managing microservices Istio. The vulnerability was fixed in versions 1.29.9, 1.30.6, and 1.31.2.\n<li class=\"l\"> curl and libcurl, the vulnerability manifests when a vulnerable version of libbrotlidec is included in dependencies.\n<li class=\"l\"> Parsers of the Web Open Font (WOFF) font format, in which<br \/>\nBrotli is used.<\/p>\n<li class=\"l\"> Brotli4j, SumatraPDF, Ghostscript, CatBoost i YTsaurus. Ranljivost je ispravljena u jednoj od a\u017euriranja.\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66537\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u0441\u0436\u0430\u0442\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 Brotli \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-111497, \u043a\u043e\u0434\u043e\u0432\u044b\u0435 \u0438\u043c\u0435\u043d\u0430 Broccoli2Shell \u0438 HTTP2Shell), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430 Brotli. \u0421\u0440\u0435\u0434\u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432: Node.js, Bun, Envoy, Istio, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183985","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u0441\u0436\u0430\u0442\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 Brotli \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-111497, \u043a\u043e\u0434\u043e\u0432\u044b\u0435 \u0438\u043c\u0435\u043d\u0430 Broccoli2Shell \u0438 HTTP2Shell), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 Brotli, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f Node.JS, Bun, \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b, HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u0441\u0436\u0430\u0442\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 Brotli \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-111497, \u043a\u043e\u0434\u043e\u0432\u044b\u0435 \u0438\u043c\u0435\u043d\u0430 Broccoli2Shell \u0438 HTTP2Shell), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-24T21:40:31+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-24T21:40:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriti\u010dna ranljivost u dekoderu Brotli, koja poga\u0111a Node.JS, Bun, preglednike, HTTP klijente i druge projekte | ProHoster","description":"U biblioteci sa referentnom implementacijom dekodera formata kompresije podataka Brotli otkrivena je ranljivost (CVE-2026-111497, kodna imena Broccoli2Shell i HTTP2Shell), koja dovodi do preljeva bafera prilikom obrade.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 Brotli, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f Node.JS, Bun, \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b, HTTP-\u043a\u043b\u0438\u0435\u043d\u0442\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430 \u0444\u043e\u0440\u043c\u0430\u0442\u0430 \u0441\u0436\u0430\u0442\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 Brotli \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-111497, \u043a\u043e\u0434\u043e\u0432\u044b\u0435 \u0438\u043c\u0435\u043d\u0430 Broccoli2Shell \u0438 HTTP2Shell), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-24T21:40:31+00:00","article:modified_time":"2026-10-24T21:40:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183985","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=183985"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183985\/revisions"}],"predecessor-version":[{"id":183986,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183985\/revisions\/183986"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=183985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=183985"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=183985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}