Node.js RCE orqasidagi Brotli dekoder xatosi Bun, Python va boshqa keng tarqalgan dasturlarni ham ta'sir qiladi

Google'ning Brotli dekoderidagi xotira buzilishi xatosi Brotli bilan siqilgan ma'lumotlarni ochadigan ko'plab dasturlarda uchraydi, jumladan Bun, Microsoft'ning .NET, Python Brotli va brotlicffi paketlari, hamda Brotli dekompressiyasini sozlashgan Envoy proksilarida.

CVE-2026-111497 sifatida kuzatilgan bu xato maxsus tayyorlangan siqilgan ma'lumotlar bufer oxiridan o'tib yozilishiga va dastur xotirasini buzishiga imkon beradi, bu esa potentsial ravishda ishdan chiqish, xotira sizib chiqishi yoki hujumchi nazoratidagi kodni bajarilishiga olib kelishi mumkin.

Imperva tadqiqotchilari kodni bitta yangilanmagan Node.js qurilmasida bajarish mumkinligini ko'rsatdi. Boshqa dasturlarda bu hali namoyish etilmagan va haqiqiy dunyoda hujumlar haqida xabar berilmagan.

Xato birinchi marta 21-oktabrda e'lon qilindi, o'shanda Node.js va Google tuzatishlarni chiqardi, shundan beri har bir mahsulot bo'yicha ko'proq tuzatishlar keldi. Xato Google dekoderida bo'lgani va har bir dastur o'z nusxasini o'zi yangilashi kerakligi sababli, har biri o'z nusxasini mustaqil ravishda yangilashi kerak.

Brotli — Google'dan kelgan siqish formati bo'lib, veb-sahifalar va boshqa trafikni kichraytirish uchun keng qo'llaniladi. Xato Brotli oqimini ochadigan C kodida, shuning uchun u til muhitlaridan proksilargacha, Python paketlarigacha ushbu kodni qayta ishlatadigan har narsaga tarqaladi.

Qaysi dasturlar ta'sirlangan

Dastur faqat kimdir nazorat qiladigan Brotli ma'lumotlarini dekodlasa ochiq bo'ladi. Node.js va Bun uchun bu o'rnatilgan fetch() Content-Encoding: br bilan yuborilgan javobni o'qiganda, yoki Express 5 va body-parser 2 kabi so'rov tanasi kodlari Brotli yuklamasini ochganda sodir bo'ladi. Oddiy Node.js HTTP serveri so'rov tanalarini o'zi dekodlamaydi.

Envoy va Istio faqat Brotli dekompressiyasi yoqilgan bo'lsa, masalan Envoy filtri orqali, ta'sirlanadi. U o'chirilgan bo'lsa, xatoga erishib bo'lmaydi.

Python'da xavf Brotli yoki brotlicffi paketi o'rnatilgan bo'lishidan kelib chiqadi. Ular mavjud bo'lgach, requests, urllib3, httpx va aiohttp kabi HTTP mijozlari Brotli javoblarini o'zlari dekodlaydi, shuning uchun dastur o'z kodida Brotli'ni import qilmasa ham ochiq bo'lishi mumkin.

Veb-ilova xavfsizlik devori (WAF) faqat ma'lum darajada yordam beradi. E'lon kunida xavfsizlik devori qoidalarini qo'shgan Vercel, bu qoidalar "sizning funksiyalaringiz boshqa serverlardan oladigan javoblarni" qamrab olmasligini aytdi. Bu yo'l uchun faqat muhit yoki kutubxonani yangilash teshikni yopadi.

Xato qanchalik uzoqqa surilishi mumkinligi dasturga bog'liq. Imperva'ning Red Team'i, o'z ishini Node2Shell deb ataydi, Linux ARM64 uchun yangilanmagan Node.js 24.22.0 qurilmasida hujumchi taqdim etgan kodni bajarib, uni ham olingan javob, ham Express so'rov tanasi sifatida yetkazdi. Ekspluatatsiya bir necha urinishni talab qildi, e'lon qilinmadi va boshqa qurilmalarda sinovdan o'tkazilmadi.

Xatoni xabar qilgan OpenAI'ning Codex Security jamoasi uni Brotli'da autentifikatsiyasiz masofaviy kod bajarilishiga imkon beruvchi deb ta'riflaydi va Node.js, Bun va Envoy'ni ta'sirlangan dasturlar sifatida ro'yxatga oladi. Ularning hisobida xato har ikki yo'nalishda ishlaydi: yangilanmagan server siqilgan kirishni qabul qilsa, yomon niyatli mijoz tomonidan egallanishi mumkin, va siqilgan kirishni qabul qiladigan yangilanmagan mijoz (masalan "curl --compressed") yomon niyatli server tomonidan egallanishi mumkin.

Haqiqiy dunyoda ekspluatatsiya haqida xabar berilmagan. CISA'ning 23-oktabrdagi bahosi ekspluatatsiyani "yo'q" va avtomatlashtirishni "yo'q" deb qayd etdi, Red Hat esa kodni bajarish uchun ishonchli ommaviy isbot-konsepsiya yo'qligini aytdi.

Jiddiylik baholari kim baholayotganiga qarab farq qiladi. CVE'ni tayinlagan Google uni CVSS 4.0 shkalasi bo'yicha 9.2, ya'ni kritik deb baholaydi. Node.js uni yuqori, Red Hat esa 8.1, ya'ni muhim deb baholaydi. Microsoft .NET uchun 8.1, ya'ni yuqori deb baholaydi.

Tuzatishning g'ayrioddiy tarixi bor. Xatoni yopadigan o'zgarish Brotli manba kodiga 27-fevralda qo'shilgan, lekin 21-oktabrgacha hech qanday yangi Brotli relizi uni o'z ichiga olmagan. OpenAI aytishicha, asosiy sabab "aslida Brotli manba kodida fevralda tuzatilgan, lekin o'sha paytda bu xavfsizlik zaifligiga olib kelishi ma'lum emas edi va Brotli'ning yangi relizi yo'q edi."

Node.js xatoni xabar qilgan OpenAI Codex Security'dan Khai Tran va Sylvie Mayer'ni, hamda tuzatish uchun Matteo Collina va Antoine du Hamel'ni kreditlaydi.

Hozir nima qilish kerak

Yuqoridagi jadvaldan tuzatilgan versiyaga yangilang, so'ngra xizmatni qayta ishga tushiring va har qanday konteyner tasvirini qayta quring, chunki ishlayotgan jarayon qayta ishga tushguncha eski dekoderni saqlaydi.

Agar hozircha yangilay olmasangiz, ishonchsiz Brotli'ni dekodlashni to'xtating. OpenAI'ning e'lon sahifasi va Aikido xavfsizlik firmasi ikkalasi ham tavsiya qiladi:

• Har qanday proksi yoki parser tanani dekodlashdan oldin Content-Encoding: br bilan kiruvchi so'rovlarni rad eting.
• HTTP mijozlarida avtomatik Brotli dekodlashni o'chiring va Brotli javoblarini dekodlashdan oldin rad eting.
• Python'da Brotli va brotlicffi paketlarini o'chiring, shunda mijozlar gzip va deflate'ga qaytadi.

Accept-Encoding sarlavhasidan br ni tushirish o'zi yetarli emas, chunki server mijoz nima so'rashidan qat'i nazar Brotli yuborishi mumkin. Node.js uchun hech qanday vaqtinchalik yechim e'lon qilinmagan, shuning uchun muhitni yangilash yagona tuzatishdir.

Tizim paketlari turli vaqtlarda tuzatilmoqda. Debian o'z brotli paketini Debian 13 (trixie) uchun 23-oktabrda 1.1.0-2+deb13u1 versiyasida, va keyinchalik Debian 12 (bookworm) uchun 1.0.9-2+deb12u1 versiyasida tuzatdi. Amazon Linux 2023, 22-oktabrda brotli va Node.js 24 paketlarini tuzatish kutilayotgan deb ro'yxatga olgan, 24-oktabrda ikkalasining tuzatilgan versiyalarini chiqardi. openSUSE Tumbleweed brotli va Node.js 24 paketlarini tuzatdi, SUSE'ning SUSE Linux Enterprise 15 uchun Node.js 22 yangilanishlari 26-oktabr holatiga ko'ra hali sinovda edi. Ubuntu hali ham ro'yxatga olingan barcha relizlarida brotli va nodejs paketlarini baholash kerak deb ko'rsatmoqda.

Bog'liqlik skanerlari Python paketlarini hali ham aniqlamasligi mumkin. CVE yozuvi Google Brotli omborini nomlaydi, PyPI paketlarini emas, va GitHub maslahati hali ham ta'sirlangan paket yo'qligini ro'yxatga oladi, bu Dependabot o'qiydigan narsadir. Ikki Python paketi uchun maslahatchi yozuvlari, PYSEC-2026-4322 va PYSEC-2026-4323, 23-oktabrda qo'shildi, shuning uchun o'rnatilgan versiyalarni qo'lda ham tekshiring.

Yangilanish: Microsoft .NET'ni tuzatdi, ko'proq tuzatishlar keldi

Microsoft 25-oktabrda .NET 8, .NET 9 va .NET 10, hamda .NET 11 Release Candidate 3 uchun xatoni tuzatuvchi navbatdan tashqari yangilanishlarni chiqardi. Tuzatilgan muhitlar 8.0.33, 9.0.22 va 10.0.14, Microsoft maslahati .NET Framework ta'sirlanmaganligini aytadi.

.NET ilovasi faqat hujumchi nazorat qiladigan Brotli ma'lumotlarini dekodlasa ochiq bo'ladi. Bu ASP.NET Core so'rov dekompressiyasida yoki HttpClient avtomatik javob dekompressiyasida Brotli yoqilganda sodir bo'ladi, ikkalasi ham sukut bo'yicha yoqilmagan, yoki ishonchsiz ma'lumotni BrotliStream va BrotliDecoder kabi Brotli API'lariga uzatganda. Microsoft ta'sirlangan paket o'rnatilgan bo'lishi o'zi ilovani ochiq qilmasligini aytadi.

Microsoft xato autentifikatsiyasiz hujumchiga jarayon xotirasini o'qish yoki buzish imkonini berishini, bu esa ma'lumot sizib chiqishi, xizmat rad etilishi yoki imtiyoz oshirishiga olib kelishi mumkinligini aytadi. Uning maslahati natijalar orasida masofaviy kod bajarilishini ro'yxatga olmaydi.

Yangilangan muhitni o'rnatish va qayta ishga tushirish umumiy muhitdan foydalanadigan ilovalar uchun yetarli. Mustaqil ilovalar qayta qurilishi va qayta nashr etilishi kerak, NativeAOT ilovalari ham shunday, chunki dekoder bajariladigan faylga bog'langan. Konteyner tasvirlari yangilangan .NET tasvirlaridan qayta qurilishi kerak.

Agar ilova hozircha yangilana olmasa, Microsoft mavjud so'rov dekompressiya sozlamasidan br provayderini olib tashlashni va mavjud HttpClient ishlov beruvchisidan DecompressionMethods.Brotli ni tushirishni maslahat beradi. U dekompressiyani hali ishlatmaydigan ilovaga qo'shishdan ogohlantiradi, chunki bu yangi xizmat rad etish xavflarini yaratishi mumkin.

Xuddi shu relizda CVE-2026-114148 ham tuzatilgan, bu ba'zi Linux .NET tarballarida noto'g'ri fayl egaligi mahalliy hujumchiga yuqori imtiyoz olish imkonini beradigan alohida xato.

Ruby uchun brotli gem'i 24-oktabrda 0.9.1 versiyasida xatoni tuzatdi. U Brotli 1.2.1 ni o'z ichiga oladi va tuzatishsiz tizim Brotli kutubxonasini e'tiborsiz qoldirib, o'z nusxasidan foydalanadi.

Cloudflare 25-oktabrda o'z boshqariladigan xavfsizlik devori qoidalar to'plamiga xato uchun ikkita qoida qo'shdi, jumladan Content-Encoding: br bilan yuborilgan kiruvchi so'rovlarni moslashtiradigan biri. Ikkalasi ham sukut bo'yicha faqat mos keladigan trafikni qayd qiladi va mijoz harakatni o'zgartirmaguncha hech narsani bloklamaydi.

Yangilanish: JFrog xatoni FFmpeg, ClickHouse va Apache Arrow'da topdi

JFrog tadqiqotchilari 25-oktabrda xato FFmpeg, ClickHouse va Apache Arrow'ga ham yetishini, va bu yo'llarning ba'zilari fayl bilan boshlanishini, veb-so'rov bilan emas, xabar qildi. Tarmoq chekkasida Content-Encoding: br ni rad etish bu fayl yo'llarini qamrab olmaydi.

FFmpeg'da yo'l libjxl, JPEG XL tasvir kutubxonasi orqali o'tadi, u JPEG XL fayli ichidagi siqilgan metama'lumotlarni ochish uchun Brotli'dan foydalanadi. Maxsus tayyorlangan tasvir JFrog'ga dastur ko'rsatkichini (qaysi kod bajarilishini hal qiladigan) nazorat qilish imkonini berdi, garchi JFrog bu kod bajarilishiga aylantirish uchun ko'proq ish kerakligini aytdi. JFrog FFmpeg uchun maxsus tuzatish haqida xabar bermadi. Xato libjxl foydalanadigan Brotli kutubxonasida, shuning uchun bu kutubxonaning tuzatilgan nusxasi bu yo'lni yopadi.

Ochiq manbali ma'lumotlar bazasi ClickHouse, JFrog'ga ko'ra, Content-Encoding: br bilan yuborilgan HTTP so'rov tanalarida, .br fayllarida va Parquet ma'lumotlarida Brotli'ni dekodlaydi. JFrog ClickHouse serverini taxminan 23 MB hajmdagi bitta maxsus tayyorlangan so'rov bilan ishdan chiqardi, bu xizmat rad etilishi, va kod bajarilishini da'vo qilmadi. JFrog nashr etilganda tuzatilgan reliz chiqmaganini aytdi, va ClickHouse'ning o'rnatilgan Brotli'ni 1.2.1 ga ko'chiradigan orqaga qaytish 26-oktabrda 26.9 shoxiga birlashtirildi.

Apache Arrow'ning C++ kutubxonasi o'z qurilishlari uchun Brotli 1.0.9 ni o'z ichiga oladi, loyihaning kuzatuvchisidagi ochiq masalaga ko'ra, u 26-oktabr holatiga ko'ra bog'langan tuzatish yoki saqlovchi javobi yo'q edi. Masala Brotli bilan siqilgan ma'lumotlar bilan Parquet yoki Arrow IPC faylini o'qish xatoga erishishi mumkinligini, va tuzatilgan tizim Brotli bilan bog'langan qurilishlar ta'sirlanmaganligini aytadi. pyarrow'da, Python paketida, JFrog 534 baytli kirish Brotli dekompressiyasini CPU'ni band qiladigan cheksiz tsiklga yuborganini topdi, bu kod bajarilish emas, balki xizmat rad etilishi.

JFrog shuningdek .NET test dasturini Brotli API'lari orqali ishdan chiqardi, bu Microsoft'ning 25-oktabrdagi yangilanishlari tuzatadigan yo'l.

(Maqola 26-oktabrda nashr etilgandan so'ng yangilandi, Microsoft'ning .NET tuzatishlari, JFrog'ning boshqa ta'sirlangan dasturlar bo'yicha tadqiqoti, Ruby gem tuzatishi, Cloudflare'ning xavfsizlik devori qoidalari va yangi Linux tarqatish paketlarini o'z ichiga olish uchun.)

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.

Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of attacker-controlled code.

Imperva researchers have shown that code can run on one unpatched Node.js build. The same has not been demonstrated on the other software, and no real-world attacks have been reported.

The flaw was first disclosed on October 21, when Node.js and Google shipped fixes, and more have followed product by product since. Because the bug is in Google's decoder and each program ships its own copy of it, every one has to update that copy on its own.

Brotli is a compression format from Google, used across the web to shrink pages and other traffic. The bug is in the C code that unpacks a Brotli stream, so it travels into anything that reuses that code, from language runtimes to proxies to Python packages.

Which Software Is Affected

A program is exposed only if it decodes Brotli data that someone else controls. For Node.js and Bun, that happens when the built-in fetch() reads a response sent with Content-Encoding: br, or when request-body code such as Express 5 and body-parser 2 unpacks a Brotli upload. A plain Node.js HTTP server does not decode request bodies on its own.

Envoy and Istio are affected only when Brotli decompression is enabled, for example, through an Envoy filter. Where it is off, the flaw cannot be reached.

In Python, the risk comes from the Brotli or brotlicffi package being installed at all. Once either is present, HTTP clients such as requests, urllib3, httpx, and aiohttp decode Brotli responses on their own, so an application can be exposed without ever importing Brotli in its own code.

A web application firewall helps only so far. Vercel, which added firewall rules on the day of disclosure, said those rules do not cover "responses your functions fetch from other servers." For that path, only updating the runtime or library closes the hole.

How far the flaw can be pushed depends on the software. Imperva's Red Team, which calls its work Node2Shell, ran attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64, delivering it both as a fetched response and as an Express request body. The exploit took several tries, has not been released, and was not tested on other builds.

OpenAI, whose Codex Security team reported the flaw, describes it as enabling unauthenticated remote code execution in Brotli and lists Node.js, Bun, and Envoy as affected software. In its account, the flaw works both ways: an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as "curl --compressed") could be taken over by a malicious server.

No in-the-wild exploitation has been reported. CISA's October 23 assessment recorded exploitation as "none" and automation as "no," and Red Hat said there is no reliable public proof-of-concept for running code.

Severity ratings differ by who is scoring. Google, which assigned the CVE, rates it 9.2, or critical, on the CVSS 4.0 scale. Node.js calls it high, and Red Hat rates it 8.1, or important. Microsoft scores it 8.1, or high, for .NET.

The fix has an unusual history. The change that closes the flaw was added to Brotli's source code on February 27, but no new Brotli release carried it until October 21. OpenAI said the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli."

Node.js credits Khai Tran and Sylvie Mayer of OpenAI's Codex Security for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the fix.

What to Do Now

Update to a fixed version from the table above, then restart the service and rebuild any container image, because a running process keeps the old decoder until it restarts.

Where you cannot update yet, stop decoding untrusted Brotli. OpenAI's disclosure page and the security firm Aikido both recommend:

• Reject incoming requests with Content-Encoding: br before any proxy or parser decodes the body.
• Turn off automatic Brotli decoding in HTTP clients, and reject Brotli responses before they are decoded.
• In Python, uninstall the Brotli and brotlicffi packages so clients fall back to gzip and deflate.

Dropping br from the Accept-Encoding header does not help on its own, because a server can send Brotli whatever the client asks for. For Node.js, no workaround has been published, so updating the runtime is the only fix.

System packages are being fixed at different times. Debian fixed its brotli package for Debian 13 (trixie) on October 23 in version 1.1.0-2+deb13u1, and has since fixed Debian 12 (bookworm) in version 1.0.9-2+deb12u1. Amazon Linux 2023, which listed its brotli and Node.js 24 packages as pending a fix on October 22, shipped fixed versions of both on October 24. openSUSE Tumbleweed has fixed brotli and Node.js 24 packages, while SUSE's Node.js 22 updates for SUSE Linux Enterprise 15 were still in testing as of October 26. Ubuntu still listed its brotli and nodejs packages as needing evaluation on all its listed releases.

Dependency scanners may not flag the Python packages yet. The CVE record names Google's Brotli repository, not the PyPI packages, and GitHub's advisory still lists no affected package, which is what Dependabot reads. Advisory entries for the two Python packages, PYSEC-2026-4322 and PYSEC-2026-4323, were added on October 23, so check the installed versions manually as well.

Update: Microsoft Patches .NET as More Fixes Arrive

Microsoft released out-of-band updates on October 25 that fix the flaw in .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. The fixed runtimes are 8.0.33, 9.0.22, and 10.0.14, and Microsoft's advisory says .NET Framework is not affected.

A .NET app is exposed only if it decodes Brotli data an attacker controls. That happens when it turns on Brotli in ASP.NET Core request decompression or in HttpClient automatic response decompression, neither of which is on by default, or when it passes untrusted data to Brotli APIs such as BrotliStream and BrotliDecoder. Microsoft says having an affected package installed does not by itself expose an app.

Microsoft says the bug lets an unauthenticated attacker read or corrupt process memory, which could lead to information disclosure, denial of service, or elevation of privilege. Its advisory does not list remote code execution among the outcomes.

Installing the updated runtime and restarting is enough for apps that use the shared runtime. Self-contained apps must be rebuilt and republished, and so must NativeAOT apps, because the decoder is linked into the executable. Container images need to be rebuilt from the updated .NET images.

Where an app cannot be updated yet, Microsoft advises removing the br provider from an existing request decompression setup and dropping DecompressionMethods.Brotli from an existing HttpClient handler. It warns against adding decompression to an app that does not already use it, because that can create new denial-of-service risks.

The same release also fixes CVE-2026-114148, an unrelated flaw in which incorrect file ownership in some Linux .NET tarballs could let a local attacker gain higher privileges.

The brotli gem for Ruby fixed the flaw in version 0.9.1 on October 24. It bundles Brotli 1.2.1 and ignores a system Brotli library that lacks the fix, using its own copy instead.

Cloudflare added two rules for the flaw to its managed firewall ruleset on October 25, including one that matches incoming requests sent with Content-Encoding: br. Both only log matching traffic by default and block nothing unless a customer changes their action.

Update: JFrog Finds the Flaw in FFmpeg, ClickHouse, and Apache Arrow

Researchers at JFrog reported on October 25 that the flaw also reaches FFmpeg, ClickHouse, and Apache Arrow, and that some of these paths start with a file rather than a web request. Rejecting Content-Encoding: br at the network edge does not cover those file paths.

In FFmpeg, the path runs through libjxl, the JPEG XL image library, which uses Brotli to unpack compressed metadata inside a JPEG XL file. A crafted image let JFrog take control of the program's instruction pointer, which decides what code runs next, though JFrog said turning that into code execution would take more work. JFrog did not report a fix specific to FFmpeg. The flaw sits in the Brotli library that libjxl uses, so a patched copy of that library closes this path.

ClickHouse, the open-source database, decodes Brotli in HTTP request bodies sent with Content-Encoding: br, in .br files, and in Parquet data, according to the pull request that fixes it. JFrog crashed a ClickHouse server with a single crafted request of about 23 MB, a denial of service, and did not claim code execution. JFrog said no patched release had shipped when it published, and a backport moving ClickHouse's bundled Brotli to 1.2.1 was merged into the 26.9 branch on October 26.

Apache Arrow's C++ library bundles Brotli 1.0.9 for its own builds, according to an open issue in the project's tracker, which had no linked fix or maintainer reply as of October 26. The issue says reading a Parquet or Arrow IPC file with Brotli-compressed data can reach the bug, and that builds linking a patched system Brotli are not affected. In pyarrow, the Python package, JFrog found that a 534-byte input sent Brotli decompression into an endless loop that kept the CPU busy, a denial of service rather than a crash.

JFrog also crashed a .NET test program through its Brotli APIs, the path Microsoft's October 25 updates fix.

(The story was updated after publication on October 26, to include Microsoft's .NET fixes, JFrog's research on other affected software, the Ruby gem fix, Cloudflare's firewall rules, and new Linux distribution packages.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.