A Vulnerability in Brotli Library Could Allow for Remote Code Execution

A vulnerability has been discovered in the Brotli library that could allow for remote code execution. Brotli is a compression algorithm developed by Google and commonly used to compress web content before it is sent over HTTP. Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE). Web servers and applications that decompress Brotli data from untrusted sources, such as those running Node.js, may be affected.

There are no reports of malicious exploitation in the wild. However, public proof-of-concept code is available.

October 27 - UPDATED THREAT INTELLIGENCE:

Public proof-of-concept exploit code is available, and exploitation attempts in the wild have been reported by third parties.

A vulnerability has been discovered in the Brotli library that could allow an attacker to corrupt memory, potentially leading to information disclosure, denial of service, or remote code execution. Details of this vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®