GHSA-9v8h-qqgm-4m35: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

DecodeBlockTypeAndLength() returns a plain boolean, so BROTLI_FALSE means both a malformed stream and a need for more input. On an invalid block switch, the decoder reports the second. The fast decode path also discards the return value. The decoder keeps running on invalid state and writes past its buffer. The Node.js bulletin describes the streaming decoder appending incoming bytes to an eight-byte internal buffer, past its end. The weakness class is an unchecked return value (CWE-252).

The attacker only needs to get a crafted Brotli stream into a decoder. No account is needed. For Python, the Brotli package compiles the vulnerable decoder from its sdist and brotlicffi vendors the same C source. Once either is installed, HTTP clients such as urllib3 and requests, httpx and aiohttp advertise Accept-Encoding: br and decode Brotli responses on their own. A malicious or compromised server can then answer with a crafted stream. Services that decode Content-Encoding: br request bodies are exposed to their callers.

The advisory lists memory corruption, memory disclosure, denial of service and possible code execution. For Python, the write-up only confirmed wrong decoder behaviour and did not pursue code execution. Code execution was reproduced on stock Node.js builds. On Python, treat a crash or memory disclosure as the realistic outcome until shown otherwise.

Affected: brotli from 1.0.3 up to but not including 1.2.1, and brotlicffi from 1.0.3 up to but not including 1.2.1.0. The write-up says earlier brotlicffi releases were not all checked. Node.js 22.x, 24.x and 26.x also bundle the decoder. Check Python installs:

pip show brotli brotlicffi

The write-up says no advisory database listed these PyPI packages as of 23 October, so pip-audit and Dependabot may not flag them. Check images and wheels that bundle them as well.

Upgrade:

pip install -U "brotli>=1.2.1" "brotlicffi>=1.2.1.0"

The patched versions are brotli 1.2.1 and brotlicffi 1.2.1.0. Rebuild every container image or wheel that bundles them. The upstream fix adds a format error (BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH) and stops decoding on both paths. Google's Brotli itself is fixed in 1.0.10, 1.1.1 and 1.2.1. Node.js users should move to v22.23.4, v24.22.1 or v26.12.1.

If you cannot upgrade, the write-up gives two options. Uninstall both packages, and HTTP clients fall back to gzip and deflate. Or stop sending br in Accept-Encoding and reject Content-Encoding: br on inbound requests.

Inventory every environment that has brotli or brotlicffi, including transitive dependencies and base images, and compare versions with the fixed ones. Look for decoder crashes: segmentation faults or worker restarts in services that fetch from third parties or accept Brotli request bodies. Check proxy and access logs for Content-Encoding: br requests and responses from untrusted peers. The sources give no other indicators of compromise.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.