Critical Brotli Bug Exposes Node and Python Apps to Remote Code Execution

A 9.2 critical flaw in Google's Brotli C decoder lets attackers run code on your servers just by sending compressed data.

Tools · Source: Hacker News

What happened

A critical vulnerability dubbed Broccoli2Shell is tearing through the web infrastructure stack. The bug lives in Google's Brotli C decoder versions 1.0.3 through 1.2.0. It causes an out-of-bounds write when processing crafted compressed data. The decoder misinterprets a malformed block switch as a request for more input. This forces the system to write attacker bytes past the end of an internal buffer. The result is a corrupted decoder state that triggers memory leaks, crashes, or full remote code execution.

The blast radius is massive because modern runtimes decompress Brotli automatically. If your Node.js application fetches a URL, the built-in fetch command decodes the response on its own. Python backends using requests, urllib3, or aiohttp do the exact same thing. Attackers can deliver the payload through webhooks, link previews, crawlers, or standard HTTP request bodies. Any server you talk to can send the malicious payload and compromise your system.

Imperva researchers already achieved remote code execution on a standard Node.js 24.22.0 Linux arm64 image. A public proof of concept is circulating on GitHub. It reportedly reaches code execution on weakened builds and causes crashes on standard builds. Patches are out for active Node releases and Python packages. Older versions like Node 20 and 23 are end of life and will receive no fix.

Key facts

Why it matters

Builders need to audit their entire stack immediately. You cannot just update your package files and walk away. A running process keeps the old decoder in memory until it restarts. You must rebuild container images on patched base layers and redeploy everything. This includes production servers, staging environments, CI runners, serverless runtimes, and developer laptops. The operational overhead is brutal but necessary.

This exposes the hidden risk of automatic optimizations in our networking libraries. HTTP clients silently accepting and decoding Brotli responses created a massive attack surface. We traded security for bandwidth efficiency without realizing the cost. Security teams will likely start disabling automatic decompression features by default. Developers will be forced to handle encoding explicitly and validate streams before passing them to system-level decoders.

For builders

Audit Node and Python runtimes immediately

Upgrade Node.js to 26.12.1, 24.22.1, or 22.23.4 immediately. Python developers must bump Brotli and brotlicffi to 1.2.1 and regenerate lockfiles. If you run end-of-life Node versions like 20 or 23, you lose because no patch is coming and you must migrate to a supported release.

Block Brotli requests at the proxy level

If you cannot patch immediately, configure your load balancer or WAF to reject Brotli request bodies. Several providers like Vercel deployed rules for this on disclosure day. This protects inbound traffic but leaves outbound fetch requests vulnerable. You pay the price of higher bandwidth costs to buy time for patching.

Rebuild all static and vendored dependencies

Distribution updates do not fix statically linked copies of the C decoder. You must manually update and rebuild projects that vendor their own Brotli library. Maintainers who ignore this will ship vulnerable binaries to their users. Check your dependencies carefully because GitHub code search skips submodules.

My take

I build AI tools that constantly fetch external URLs and process webhooks. This bug is a nightmare scenario because the vulnerability triggers before your application code even runs. Relying on automatic decompression was a mistake. Stop building new features today, rebuild your base images, and get off end-of-life Node versions before you get compromised.

Original reporting: Hacker News. This is my rewrite and opinion.

More AI news for builders