Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
High
Availability (Vulnerable System)
High
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
Affected products
- Google / Brotli1.0.3 – 1.0.10
- Google / Brotli1.1.0 – 1.1.1
- Google / Brotli1.2.0 – 1.2.1
Exploits & proofs of concept
- nucleiNode.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Executionby assetnote,DhiyaneshDk
News coverage
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawThe Hacker News · 9h ago
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used SoftwareThe Hacker News · 3d ago
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataThe Hacker News · 4d ago
Updated 22m ago · 8 sources