{"id":"GHSA-9v8h-qqgm-4m35","kind":"vulnerability","aliases":["GHSA-9v8h-qqgm-4m35"],"related":[],"title":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","summary":"The Brotli decoder in the PyPI brotli and brotlicffi packages has an out-of-bounds write triggered by a crafted Brotli-compressed stream. A remote unauthenticated attacker can corrupt decoder memory, read sensitive memory, cause a denial of service, or potentially run arbitrary code.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"brotli","fixed":["1.2.1"],"affected":">= 1.0.3, < 1.2.1","ecosystem":"pypi"},{"name":"brotlicffi","fixed":["1.2.1.0"],"affected":">= 1.0.3, < 1.2.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["brotli","brotlicffi","cwe-252","package","pypi","python"],"not_affected_if":["brotli-below-1.0.3","brotli-not-installed"],"how_to_check":"pip show brotli brotlicffi\nCheck that brotli is below 1.2.1 or brotlicffi is below 1.2.1.0","fix":"Upgrade pypi brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later.\nThe advisory also lists 1.0.10 and 1.1.1 as fixed releases on their respective branches.","status":"open","published_at":"2026-10-22T15:32:49+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:10:05+00:00","updated_at":"2026-10-23T20:10:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:10:05Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade pypi brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later.\nThe advisory also lists 1.0.10 and 1.1.1 as fixed releases on their respective branches.","summary":"The Brotli decoder in the PyPI brotli and brotlicffi packages has an out-of-bounds write triggered by a crafted Brotli-compressed stream. A remote unauthenticated attacker can corrupt decoder memory, read sensitive memory, cause a denial of service, or potentially run arbitrary code.","category":"package","who_cares":["python","pypi","brotli","brotlicffi"],"confidence":0.8,"analyst_note":"Confirm whether the sources say which branch fixes apply to brotlicffi and whether the exploit requires decoding untrusted input, via https://github.com/advisories/GHSA-9v8h-qqgm-4m35.","how_to_check":"pip show brotli brotlicffi\nCheck that brotli is below 1.2.1 or brotlicffi is below 1.2.1.0\nunknown","needs_analyst":true,"not_affected_if":["brotli-not-installed","brotli-below-1.0.3"],"severity_if_unknown":"critical"},"cost_usd":0.000438,"input_tokens":2220,"output_tokens":433,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-252':33B '1.0.10':152C '1.0.3':96C,144C '1.1.1':154C '1.2.0':98C,146C '1.2.1':156C '4m35':22A,27A '9v8h':20A,25A 'adjac':109C 'affect':13A 'allow':102C 'also':12A 'arbitrari':81B,125C 'attack':65B,106C 'avail':150C 'binari':142C 'bound':5A,52B 'brot':1A,9A,16A,30B,38B,43B,59B,89C,94C,131C,139C 'brotli':28A 'brotli-compress':58B,130C 'brotlicffi':29A,31B,45B 'buffer':84C 'c/dec/decode.c':91C 'caus':73B,117C 'code':82B,126C 'compress':60B,132C 'content':116C 'corrupt':67B,108C 'craft':57B,129C 'cwe':32B 'decod':10A,39B,68B,90C,110C 'denial':75B,119C 'disclos':113C 'execut':124C 'ghsa':19A,24A 'ghsa-9v8h-qqgm-4m35':18A,23A 'googl':93C 'latest':149C 'librari':140C 'memori':69B,72B,112C,115C 'need':135C 'node2shell':11A 'out-of-bound':2A,49B 'overflow':85C 'packag':17A,34B,46B 'platform':101C 'potenti':79B,123C 'pypi':15A,35B,42B 'python':36B 'qqgm':21A,26A 'read':70B 'remot':63B,104C 'run':80B 'sensit':71B,114C 'servic':77B,121C 'state':111C 'stream':61B,133C 'trigger':54B 'unauthent':64B,105C 'updat':137C 'use':127C 'user':134C 'version':95C,151C 'vulner':86C 'write':6A,53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T15:32:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","severity":"critical","published_at":"2026-10-22T15:32:49+00:00","modified_at":"2026-10-23T19:08:11+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T20:45:22+00:00","note":null}],"documents":[{"id":528,"url":"https://news.ycombinator.com/item?id=50207180","title":"Brotli vulnerability affects curl and Git","kind":"post","source":"hackernews","text":"Brotli vulnerability affects curl and Git\nhttps://github.com/advisories/GHSA-9v8h-qqgm-4m35\n\n12 points, 5 comments on Hacker News","published_at":"2026-10-23T11:10:53+00:00","relation":"discussion","confidence":null,"note":"12 points, 5 comments"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}