Published on: 26 October 2026
A buffer overflow vulnerability exists in the Brotli decoder. It allows a remote, unauthenticated attacker to use a crafted Brotli compressed stream to corrupt adjacent decoder state memory. This can lead to sensitive memory disclosure, denial of service, or arbitrary code execution.
A proof of concept (PoC) of the vulnerability is available on the Internet. System administrators are advised to take immediate action to patch affected systems or applications to mitigate the elevated risk of cyber attacks.
Successful exploitation of this vulnerability could lead to remote code execution, information disclosure and denial of service on an affected system.
Google has released new versions of the Brotli library to address the issue, and the source code along with update details can be downloaded at the following URL:
https://github.com/google/brotli
In addition to in-house and self-developed systems or applications, commercial products and open-source software/libraries (such as web servers, Python packages, and runtime environments like Node.js) may also be affected by the vulnerability. It is strongly recommended to consult product vendors if the used software products are affected and corresponding patches/mitigation measures are available. If so, system administrators should apply the patches or follow the recommendations provided by the product vendors to mitigate the risk.