Brotli decoder fixes matter beyond the web server
A flaw in Google’s C Brotli decoder can turn malformed compressed input into memory corruption, with possible crashes, memory disclosure or code execution. Node.js bundles the decoder, and Python’s Brotli and brotlicffi packages are affected too. The Node security releases and Python package fixes are available; applications that decompress untrusted data need the patched runtime or library, including copies inside deployed images.
The Node.js Project · Oct 21, 2026
Why it matters
Developers should check the decoder actually loaded by each service, rather than assuming a system-library update covers every runtime.
More context
Node’s October 21 fixes are in 22.23.4, 24.22.1 and 26.12.1. The GitHub advisory lists Python Brotli 1.2.1 and brotlicffi 1.2.1.0 as patched. Review dependency pins, rebuild affected images and restart processes so they load the replacement.
Keep in mind
Exposure requires an application path that decodes attacker-controlled Brotli data. These versions address this issue; the advisory does not establish that every service using those languages was exploitable.
Original read