Observed arrival · 2026-10-25
Broccoli2Shell’s claimed Brotli decoder flaw
Credibility concern recorded. The source reference remains available for verification and correction.
A technical advisory page describes a claimed critical Brotli decoder vulnerability and lists affected Node.js, Python, and bundled-decoder versions.
- For
- Node.js and Python maintainers handling Brotli data
- Worth noticing
- The page says restarting a process is not enough: it calls for rebuilding container images on a patched base and redeploying.
Field notes
The advisory connects several possible input paths to the decoder, including automatic HTTP response decompression, request-body parsing, uploads, and direct API calls. Its version table distinguishes Node.js lines with listed fixes from older lines it describes as end of life, and it warns that running processes and container images need separate restarts or rebuilds. The page links to named projects and advisory sources, but the supplied extract does not establish that its vulnerability claims are accurate.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue