Google Brotli Unchecked Return Value Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 27/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| brotli | ≥ 1.0.3, < 1.2.1< 1.2.1 | 1.2.1 |
| brotlicffi | ≥ 1.0.3, < 1.2.1.0< 1.2.1.0 | 1.2.1.0 |
| p7zip | ≤ 16.02 | |
| brotli | < 1.2.7 | 1.2.7 |
| bun | < 1.4.4 | 1.4.4 |
| arrow | = 27.0.0≤ 26.0.0 | |
| clickhouse | ≤ 26.10.2.103 | |
| duckdb | ≤ 2.0.0 | |
| envoy | ≥ 1.38.0, < 1.38.6≥ 1.39.0, < 1.39.3< 1.37.8 | 1.38.61.39.31.37.8 |
| brotli | ≥ 1.0.3, < 1.0.10≥ 1.1.0, < 1.1.1≥ 1.2.0, < 1.2.1 | 1.0.101.1.11.2.1 |
| istio | ≥ 1.30.0, < 1.30.6≥ 1.31.0, < 1.31.2< 1.29.9 | 1.30.61.31.21.29.9 |
| 7-zip-zstd | ≤ 26.02-1.5.7-r2 | |
| .net | = 11.0.0≥ 10.0.0, < 10.0.14≥ 8.0.0, < 8.0.33≥ 9.0.0, < 9.0.22 | 10.0.148.0.339.0.22 |
| node.js | ≥ 23.0.0, < 24.22.1≥ 25.0.0, < 26.12.1< 22.23.4 | 24.22.126.12.122.23.4 |
| brotlicffi | < 1.2.1.0 | 1.2.1.0 |
| edk2 | ≤ 202608 |
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free