A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
| Vendor | Product | Versions |
|---|---|---|
| brotli | 1.0.3, 1.1.0, 1.2.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | node.js | cert_advisory | 90% |
Loading…
Updated severity to CRITICAL, confirmed PoC exploits available, corrected affected versions to 1.0.3-1.0.9/1.1.0/1.2.0, added detailed technical description of the buffer overflow mechanism, and added MITRE ATT&CK techniques T1190 and T1499.004 with HTTP2Shell/Node2Shell tags.
Updated severity from NONE to HIGH, corrected CVSS score to 9.2 (CVSSv4), expanded affected versions list to include all minor versions between 1.0.3-1.0.9, and clarified patch versions as 1.0.10, 1.1.1, 1.2.1.
Added 24 newly identified affected products and projects from community vulnerability tracking resource (broccoli2shell.com), including browsers, compression tools, image processing libraries, and language runtimes.
Added new affected applications: git-remote-https and libcurl, with note about CURLOPT_ENCODING alias for vulnerability scanning.
Updated severity to CRITICAL, corrected CVSS score from 9.8 to 9.2 (Google's official CVSS v4 score), and added new affected vendors/products (Microsoft, Visual Studio, PowerShell, .NET) and tags reflecting broader impact.
Severity updated from NONE to HIGH; article indicates privilege escalation impact in .NET environment
Added new affected software tags: Bun, Python Brotli package, and brotlicffi package confirmed to be impacted by the vulnerability.
Updated severity from NONE to HIGH, expanded affected versions list to include all versions between 1.0.3-1.2.0, and added tags indicating broader impact beyond Node.js (Envoy, OpenSSL, general Brotli consumers).
Exploit availability confirmed with Node2Shell PoC demonstration; marked as actively exploited; added relevant tags.
Updated severity from NONE to CRITICAL and set CVSS estimate to 9.8 based on vulnerability classification in article.
Initial creation
