---
id: "GHSA-9v8h-qqgm-4m35"
kind: "vulnerability"
aliases: ["GHSA-9v8h-qqgm-4m35"]
title: "Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "brotli", "fixed": ["1.2.1"], "affected": ">= 1.0.3, < 1.2.1", "ecosystem": "pypi"}, {"name": "brotlicffi", "fixed": ["1.2.1.0"], "affected": ">= 1.0.3, < 1.2.1.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["brotli", "brotlicffi", "cwe-252", "package", "pypi", "python"]
not_affected_if: ["brotli-below-1.0.3", "brotli-not-installed"]
published_at: "2026-10-22T15:32:49+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T20:10:05+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "first_seen_at": "2026-10-23T19:11:31+00:00"}]
---

# Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

The Brotli decoder in the PyPI brotli and brotlicffi packages has an out-of-bounds write triggered by a crafted Brotli-compressed stream. A remote unauthenticated attacker can corrupt decoder memory, read sensitive memory, cause a denial of service, or potentially run arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:brotli affected >= 1.0.3, < 1.2.1 fixed 1.2.1
- pypi:brotlicffi affected >= 1.0.3, < 1.2.1.0 fixed 1.2.1.0

## How to check

pip show brotli brotlicffi
Check that brotli is below 1.2.1 or brotlicffi is below 1.2.1.0

## Fix

Upgrade pypi brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later.
The advisory also lists 1.0.10 and 1.1.1 as fixed releases on their respective branches.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-9v8h-qqgm-4m35

## Documents

- [discussion] Brotli vulnerability affects curl and Git https://news.ycombinator.com/item?id=50207180

## From the sources

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_