What is the Brotli RCE?

Brotli is a compression format from Google, used for HTTP Content-Encoding: br, WOFF2 web fonts and general-purpose compression. Most software that supports it embeds Google's reference C library rather than writing its own decoder.

The bug is in that library's streaming decoder, in c/dec/decode.c. A compressed stream is made of blocks, and the decoder switches between block types as it reads. The Node.js advisory explains the flaw: an invalid block switch "was reported as a temporary need for more input instead of a permanent format error," so the streaming decoder kept appending input bytes to an eight-byte internal buffer. Writing past that buffer is an out-of-bounds write (CWE-787) in native memory, the starting point for corrupting the heap and, with effort, running code.

The fix makes the decoder return a format error for that transition. It shipped in Brotli 1.0.10, 1.1.1 and 1.2.1. Google, as the CVE numbering authority for Brotli, scored it 9.2 on CVSS v4; Node.js rates it High.

The exposure follows the C library, not the language. Places it is known to be bundled:

• Node.js 22.x, 24.x and 26.x, through node:zlib, fetch(), DecompressionStream and middleware such as Express 5 and body-parser 2.x. Fixed in 22.23.4, 24.22.1 and 26.12.1. See Node2Shell.
• Bun, fixed in 1.4.4.
• Python: the Brotli package up to 1.2.0 and brotlicffi up to 1.2.0.2, which requests, urllib3, httpx and aiohttp use automatically when installed. Fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0. See HTTP2Shell.
• Operating system packages (libbrotli, brotli) used by native software such as web servers, proxies and image or font tooling. Fixes arrive through your distribution's security updates.
• Anything statically linking the library, including Electron apps, single-executable binaries and vendor appliances, which only a rebuild or vendor update fixes.

Decoders that are independent reimplementations in another language, rather than wrappers around the C code, do not contain this exact code. Check each project's own advisories rather than assuming either way.

The bug only fires when attacker-controlled Brotli data is decoded. Shown for defensive context, the realistic delivery paths are:

• Inbound request bodies with Content-Encoding: br sent to a server whose middleware inflates compressed bodies.
• Responses to outbound requests, when a server-side client advertises br in Accept-Encoding and fetches a URL the attacker controls, such as a webhook, link preview or feed reader.
• Files and messages decompressed by application code, such as uploaded archives or queue payloads.

As of October 23, 2026, no exploitation in the wild had been reported. Public proof-of-concept work showed code execution in a lab after multiple attempts and on deliberately weakened builds, and a crash on stock builds. A crash is still a reliable denial-of-service against an unpatched service.

• Inventory every copy. node -p process.versions.brotli for Node.js, pip show brotli brotlicffi for Python, your package manager for libbrotli, and an image scan for statically linked copies. Dependency scanners may miss the Python fixes, which had no advisory database entry as of October 23, 2026.
• Upgrade Brotli to 1.0.10, 1.1.1 or 1.2.1 or later on your branch, or the runtime or package that bundles it, then rebuild container images.
• Reduce exposure while you patch. Reject inbound Content-Encoding: br where uploads do not need it, strip br from outbound Accept-Encoding to untrusted hosts, or remove the optional Brotli package so clients fall back to gzip.
• Watch for crashes in decompression code paths, correlated with the source of the compressed data, as an early signal of probing.

For how decoder memory bugs like this become code execution, see image-based heap overflows, the same class in image parsers.