{"id":183985,"date":"2026-10-24T23:40:31","date_gmt":"2026-10-24T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/kriticheskaya-uyazvimost-v-dekodirovshhike-brotli-zatragivayushhaya-node-js-bun-brauzery-http-klienty-i-drugie-proekty"},"modified":"2026-10-24T23:40:36","modified_gmt":"2026-10-24T21:40:36","slug":"critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","title":{"rendered":"Nj\u00eb dob\u00ebsi kritike n\u00eb dekoderin Brotli, q\u00eb ndikon n\u00eb Node.JS, Bun, shfletuesit, klient\u00ebt HTTP dhe projekte t\u00eb tjera","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb bibliotek\u00ebn me zbatimin referent t\u00eb dekodifikuesit t\u00eb formatit t\u00eb kompresimit t\u00eb dh\u00ebnave Brotli \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2026-111497, emrat kodor\u00eb Broccoli2Shell dhe HTTP2Shell), i cili \u00e7on n\u00eb mbushjen e mbetjeve gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb kompresuara t\u00eb dizajnuara ve\u00e7mas. Sipas t\u00eb dh\u00ebnave nga Google, ky vulnerabilitet mund t\u00eb p\u00ebrdoret p\u00ebr ekzekutimin e kodit n\u00eb distanc\u00eb gjat\u00eb sulmeve ndaj projekteve q\u00eb p\u00ebrdorin zbatimin zyrtar t\u00eb dekodifikuesit Brotli. Disa nga projektet e prekura nga ky vulnerabilitet p\u00ebrfshijn\u00eb: Node.js, Bun, Envoy, Istio, shfletuesit e internetit, server\u00ebt proxy, klient\u00ebt HTTP, server\u00ebt HTTP, arkivuesit, firmware-t UEFI, shikuesit JPEG XL, biblioteka q\u00eb dekodifikojn\u00eb p\u00ebrmbajtje p\u00ebr Python, Ruby, Java, PHP dhe .NET, si dhe var\u00ebsit\u00eb e lidhura. <\/p>\n
Problemi u zbulua nga kompania OpenAI n\u00eb shkurt t\u00eb k\u00ebtij viti dhe u bllokua n\u00eb baz\u00ebn e kodit Brotli p\u00ebrmes eliminimit t\u00eb rrjedhave t\u00eb pap\u00ebrshtatshme gjat\u00eb dekodifikimit. M\u00eb 22 tetor u publikuan versionet corrective Brotli 1.0.10, 1.1.1 dhe 1.2.1, ku u shpreh qart\u00eb se vulnerabiliteti ishte zgjidhur dhe problemi u korrigjua. N\u00eb k\u00ebt\u00eb dit\u00eb, u krijua nj\u00eb prototip i nj\u00eb eksploiti q\u00eb mund\u00ebsonte ekzekutimin e kodit n\u00eb distanc\u00eb n\u00eb kushte laboratorike, duke p\u00ebrdorur paketat e pazakonta (n\u00eb paketat standarde ndodhte nj\u00eb crash). M\u00eb von\u00eb, kompania Imperva dokumentoi nj\u00eb sulm ndaj paketave standarde Node.js 24.22.0 n\u00eb mjedisin Linux n\u00eb sistemin ARM64.<\/p>\n
Vulnerabiliteti \u00e7on n\u00eb shkrimin p\u00ebrtej mbetjeve p\u00ebr shkak t\u00eb trajtimit t\u00eb pap\u00ebrshtatsh\u00ebm t\u00eb gabimeve gjat\u00eb analiz\u00ebs s\u00eb blloqeve n\u00eb rrjedh\u00ebn e kompresuar. Funksioni DecodeBlockTypeAndLength() p\u00ebrve\u00e7 kodit t\u00eb gabimit ktheu vet\u00ebm vlerat true dhe false, e cila nuk i lejonte kodit thirr\u00ebs t\u00eb dallonte d\u00ebmtimin e rrjedh\u00ebs nga nj\u00eb gjendje q\u00eb k\u00ebrkonte d\u00ebrgimin e t\u00eb dh\u00ebnave shtes\u00eb n\u00eb funksion. N\u00eb rast se n\u00eb rrjedh\u00eb ishte caktuar nj\u00eb lloj blloku t\u00eb dh\u00ebnash t\u00eb kompresuara t\u00eb pap\u00ebrshtatshme, dekodifikuesi e perceptonte at\u00eb jo si nj\u00eb gabim, por si nj\u00eb gjendje t\u00eb munges\u00ebs s\u00eb t\u00eb dh\u00ebnave, q\u00eb k\u00ebrkonte lexim t\u00eb m\u00ebtejsh\u00ebm nga rrjedha. Por, pasi buffer-i i caktuar nuk ishte llogaritur p\u00ebr t\u00eb dh\u00ebnat e lexuara shtes\u00eb, ato u shkruan n\u00eb nj\u00eb zon\u00eb p\u00ebrtej kufijve t\u00eb tij, ku u ruajt gjendja e brendshme e dekodifikuesit.<\/p>\n
Projektet e ndjeshme ndaj vulnerabilitetit:<\/p>\n
\n
Biblioteka referuese brotli, problemi shfaqet q\u00eb nga l\u00ebshimi 1.0.3 dhe \u00ebsht\u00eb zgjidhur n\u00eb azhurnimet 1.0.10, 1.1.1 dhe 1.2.1. Vulnerabiliteti ndikon n\u00eb aplikacione dhe biblioteka q\u00eb p\u00ebrdorin bibliotek\u00ebn libbrotlidec.\n
JavaScript platform Node.js, problem resolved in updates 26.12.1, 24.22.1, and 22.23.4. Applications using the fetch() method to request third-party content, which automatically decodes HTTP responses with the header 'Content-Encoding: br', may be exploited. The vulnerability also manifests when directly invoking zlib.brotliDecompress*(), createBrotliDecompress(), and brotli.decompress() methods to unpack third-party content or when processing HTTP requests via Express 5 and body-parser 2.x libraries.\n
Python packages brotli and brotlicffi (fix proposed in version 1.2.1) and projects using them, including popular libraries urllib3, aiohttp, httpx, and Scrapy, decode responses with the header 'Content-Encoding: br' when accessing external web resources.\n
HTTP servers, HTTP proxies, HTTP clients, and web browsers that support Brotli compression ('Accept-Encoding: br'). Apache httpd comes with mod_brotli (disabled by default). A third-party module ngx_brotli is available for nginx (the brotli version in dependencies has been updated to current). The issue in Chrome\/Chromium and Firefox has already been resolved in one of the past updates.server<\/a> Envoy, vulnerabiliteti \u00ebsht\u00eb rregulluar n\u00eb l\u00ebshimet 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12.\n