Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

The Brotli decoder in Node.js versions 1.0.3 through 1.2.0 contains a critical vulnerability that can lead to a crash, memory leak, or remote code execution. This issue is not limited to Node.js, as Python frameworks and middleware that decode Brotli-encoded data are also affected. An attacker can send a maliciously crafted Brotli stream to a vulnerable server, which can then trigger an unchecked return value in the decoder, leading to memory corruption or code execution.

The vulnerability exists due to the decoder's inability to differentiate between malformed streams and those requiring more input, causing it to write past an eight-byte internal buffer. The fix involves returning a hard format error to the caller, preventing the exploitation of the flaw. However, many projects ship their own copy of the C decoder, meaning that a distribution update may not be sufficient to protect those applications.

It is crucial to update all affected libraries and services, including Node.js, Bun, Chromium, Firefox, brotlicffi, ngx_brotli, Brotli4j, SumatraPDF, Ghostscript, CatBoost, YTsaurus, and Gentoo, Solus, and VMware Photon packages.