erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-9v8h-qqgm-4m35: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially…

CVSS 9.2 Critical GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Oct 22, 2026

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with pip-audit (or: pip show <package>).
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
PyPIbrotli>= 1.0.3, < 1.2.11.2.1
PyPIbrotlicffi>= 1.0.3, < 1.2.1.01.2.1.0

Details

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVSS: 9.2 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Sources and references

  1. GitHub Advisory GHSA-9v8h-qqgm-4m35 github.com
  2. nvd.nist.gov nvd.nist.gov
  3. nodejs.org nodejs.org
  4. github.com github.com
  5. github.com github.com
  6. github.com github.com
  7. github.com github.com
  8. github.com github.com
  9. github.com github.com
  10. github.com github.com
  11. github.com github.com
  12. github.com github.com
  13. nodejs.org nodejs.org
  14. opensourcemalware.com opensourcemalware.com
  15. pypi.org pypi.org
  16. pypi.org pypi.org
  17. cve.org cve.org

Critical PyPI advisories · Today’s Security Digest