What happened
A vulnerability has been discovered in the Brotli library that could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or achieve remote code execution. The out‑of‑bounds write resides in the decoder (c/dec/decode.c) and is exploitable when a service decompresses untrusted Brotli data. Affected products include Google Brotli 1.0.3‑1.2.0, Node.js versions prior to 22.23.4/24.22.1/26.12.1, Bun ≤ 1.4.3, Envoy < 1.40.0, Istio < 1.31.2, Python brotli ≤ 1.2.0, Java brotli4j < 1.24.0, and any .NET app that enables Brotli decompression. Public proof‑of‑concept code is available, but no wild‑use has been observed.
Why it matters for trust and compliance
- This advisory demonstrates why organizations must maintain a continuous, auditable vulnerability‑management process that tracks third‑party library versions and patch status.
- Provide verifiable evidence of timely patching for all affected components.
- Show continuous monitoring of third‑party library inventories to satisfy control‑mapping requirements.
Who is affected
Technology / SaaS providers Financial services platforms Government web services
Recommended actions
- Identify every asset that includes the Brotli library and record its version.
- Apply the latest vendor patches or disable Brotli decompression where patching is not feasible.
- Document remediation steps in your vulnerability‑management evidence repository for audit readiness.