This one again feels overblown, at least for servers. I just checked an org of over 200 GitHub repos. Node, Python, and C#. None of them are vulnerable... because none of them actually call the Brotli decoder. It's just not enabled by default on the server side, by the platforms themselves. This is much like the PHP bugs, where specific conditions have to be in play before you're actually vulnerable.
For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.
(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)
I can't find download numbers for extras, but it comes in the pretty dang innocuous-seeming `aiohttp[speedups]`, as well. Also `urllib3[brotli]`. Many, many people will be running these servers without recognizing the name of the library, especially in the agentic era.
I might be missing something obvious in your message, cause I don't see why server/client is relevant. Why would a frontend app speak a protocol that the backend doesn't?
That's just the total number of times that package was downloaded, which is completely unrelated to how many servers it appears in? Same with `aiohttp`: aiohttp can be used as a client library.
Sure, people should check their dependency trees, and make informed decisions.
We should start naming them like hurricanes: NIST creates a list of alphabetical names and assigns any CVE >= 9.0 with a name. Vulnerability Alex (CVE 9.4)
I feel like normal security issues don't get much publicity. The PHP and eMudhra issues seemed severe, and worth publicity. But then with things like this, I'm not sure. Is this a severe issue? Or is it just a run of the mill issue that's only newsworthy because web security is on people's minds right now?
The whole industry is on edge right now, and numbers wise the CVE count has exploded beyond belief. It's probably to take the side of caution, treat everything as important and update everything promptly rather than the old way of doing things where libraries are left months or years out of date until something happens.
And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.
Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.
Apparently it doesn't contain a binding to the C library, but it does contain some compatibility and shares design decisions with it. In other words, it's not a clean-room implementation from the spec, but rather it's a port. Since this RCE is triggered by a OOB access, it's unlikely to have made it into the crate, but it's good to keep these things in mind.
I would love to hear your definition of this. Are llms used to aid in incident response? 100%. Why would I sit there and manually review data from multiple sources when I could have an agent pull from all and summarize? But to hand it off end to end? I haven't seen anyone accomplish this.
> We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development
I know that it is dead but since they provide security updates for another year I haven’t migrated off of it immediately. Anyways, the Deno runtime uses a brotli Rust crate that does not wrap C code, and with unsafe off, so I assume it is safe.
Only decompression with Google's brotli library is affected. So if you use "Brotli" or "brotlicffi" in your Python app to decompress brotli, you're vulnerable. Compressing responses with brotli from Apache is safe.
Worth checking how brotli actually reaches your stack. In Node it's bundled into the runtime itself (zlib's brotli support), so an audit of your package tree won't surface it the way a normal dependency would - the fix arrives with a runtime release, not a package bump. The Python package on PyPI is already at 1.2.1. Until your runtime picks up the patched brotli, refusing br content-encoding at the edge seems like the fastest mitigation.
For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.
(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)
I can't find download numbers for extras, but it comes in the pretty dang innocuous-seeming `aiohttp[speedups]`, as well. Also `urllib3[brotli]`. Many, many people will be running these servers without recognizing the name of the library, especially in the agentic era.
I might be missing something obvious in your message, cause I don't see why server/client is relevant. Why would a frontend app speak a protocol that the backend doesn't?
Sure, people should check their dependency trees, and make informed decisions.
https://broccoli2shell.com/
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
Another day another out of bounds access in C code.
And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.
Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.
https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338
> We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development
https://deno.com/blog/cloudflare
and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497
https://x.com/AikidoSecurity/status/2113759110625906950
whether a hello wolrd in fastapi is affected might also be interesting
That's pretty difficult if you make outbound requests, and don't already have a TLS interception proxy set up.
https://news.ycombinator.com/item?id=50069499
Edit: why flagged
Rust Derangement Syndrome is at epidemic levels here.
[1] When more than half of the "standard" https://www.rfc-editor.org/info/rfc7932/#page-44 is an opaque binary blob, they're really not encouraging independent implementations.