What it is
Brotli shrinks pages and files so they travel faster, and the software on the other end unpacks them. The bug is in that unpacking step. According to the NVD record, a crafted Brotli stream can “corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.”
The risk is in software that unpacks Brotli it didn’t make: a server or app that fetches pages or files from other sites, or accepts compressed uploads. A plain website that only serves its own pages is far less exposed, but it still runs the vulnerable code until it’s updated.
Who it touches
- Websites and apps built on Node.js. Node.js ships Brotli inside it. The Node.js October 21 security release fixes it in 22.23.4, 24.22.1 and 26.12.1. Anything older in those lines is affected.
- Servers and tools that use the Brotli library directly, in any language. Versions 1.0.3 through 1.2.0 are affected; update to 1.0.10, 1.1.1 or 1.2.1.
- Your own computer’s browser gets its fixes through normal browser updates. Keep automatic updates on.
Three questions for whoever runs your website
- Does our site or app run on Node.js?Many modern sites and booking or payment systems do. WordPress sites run on PHP instead, which has its own urgent update this month (see our PHP2Shell advisory).
- Which version, and is it on the October 21 release?22.23.4, 24.22.1 or 26.12.1, or later. If the site runs on a managed hosting platform, ask whether the platform has rolled the patched runtime out yet.
- Does anything we run fetch files from other websites?Link previews, price checkers, feed readers and website scanners all do. Those are the parts that most need the update, and they can be told to refuse Brotli until then.
Our own website scanners stopped accepting Brotli the week the fix was announced, so a malicious site can’t feed them a crafted stream while the hosting runtime catches up. If you’re not sure what your site runs, ask us.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.