Google Brotli Library (versions 1.0.3 through 1.2.0)
Brotli is a widely used data compression library developed by Google that shrinks files and web content before sending them over the internet, and is embedded in a large number of applications and programming frameworks.
Root Cause
The Brotli decoder failed to validate that incoming data would stay within its allocated buffer before writing. The underlying bug was actually fixed in Brotli's source code in February 2026, but was not recognised as a security vulnerability at the time, so no security advisory was issued until now.
Attack Vector
An attacker sends a maliciously crafted Brotli-compressed payload — either as a server response retrieved by a target application, or as a request body processed by a web framework. If the data reaches the vulnerable decoder, it can trigger memory corruption, leading to a crash or, in demonstrated cases on Node.js running on Linux, arbitrary code execution (RCE — running the attacker's own commands on the target machine). No authentication is required.
Recommended Actions
- Update Brotli to version 1.0.10, 1.1.1, or 1.2.1. Apply Microsoft's October 25 patches for .NET (8.0.33, 9.0.22, 10.0.14), Visual Studio 2019/2022/2026, and PowerShell 7.4–7.6.
- Update Python packages Brotli and brotlicffi to version 1.2.1 and 1.2.1.0 respectively.
- Review any application that fetches or processes external compressed content and confirm it runs a patched Brotli version.