A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
| Vendor | Product | Versions |
|---|---|---|
| brotli | 1.0.3, 1.1.0, 1.2.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | node.js | cert_advisory | 90% |
Loading…
Updated severity from NONE to HIGH, expanded affected versions list to include all versions between 1.0.3-1.2.0, and added tags indicating broader impact beyond Node.js (Envoy, OpenSSL, general Brotli consumers).
Exploit availability confirmed with Node2Shell PoC demonstration; marked as actively exploited; added relevant tags.
Updated severity from NONE to CRITICAL and set CVSS estimate to 9.8 based on vulnerability classification in article.
Initial creation
