Brotli
A lossless compression algorithm introduced by Google that achieves better compression ratios than gzip on web text resources. It is negotiated via Content-Encoding: br, and its decoder involves complex memory operations.
Timeline (last 90 days)
An OpenAI red-team test found an unauthenticated remote code execution vulnerability in the Brotli compression library, affecting software such as Node.js, Bun and Deno, and it has been reported and fixed.
Security research firm Aikido disclosed the HTTP2Shell vulnerability, tracked as CVE-2026-111497, which is related to the Brotli decompression stage and could allow attackers to achieve remote code execution.
Aikido's analysis points out that the same defect pattern also exists in Python's HTTP handling stack, especially when an application uses Brotli compression and delegates decompression to an underlying library, where maliciously crafted compressed data may trigger out-of-bounds or injection behavior.
Brotli is a lossless compression algorithm introduced by Google in 2015, typically achieving a 15%–25% compression ratio improvement over gzip on web text resources.
The Brotli decoder needs to maintain state such as sliding windows, dictionary references and context modeling, and its implementation involves extensive bounds checking and memory copying; insufficient validation of length fields and dictionary indices on malformed input may lead to out-of-bounds reads/writes or integer overflows.
Aikido recommends paying attention to official patches and advisories and adding dependency scanning to CI pipelines, because the vulnerability involves the HTTP request handling path, and even if an application does not directly call Brotli it may still be passively exposed through framework default configurations.
Many web frameworks and API gateways enable Brotli decompression by default to optimize transmission, so even if application code never explicitly calls a decompression function, request bodies may be automatically decoded at the middleware layer.
Checking only for Brotli calls in business code is insufficient; it is also necessary to confirm whether framework versions, reverse proxies (such as Nginx and Envoy) and WSGI/ASGI servers are affected, and to evaluate mitigation measures such as disabling unnecessary compression encodings or limiting request body size.
HTTP2Shell chains together HTTP/2 frame handling and Brotli decompression, amplifying the impact of a single-point defect.
Mature lossless compression algorithms (such as zstd and Brotli) can typically compress English web text to approximately 2–3 bpb.
All Facts (10)
An OpenAI red-team test found an unauthenticated remote code execution vulnerability in the Brotli compression library, affecting software such as Node.js, Bun and Deno, and it has been reported and fixed.
50%UnverifiedSecurity research firm Aikido disclosed the HTTP2Shell vulnerability, tracked as CVE-2026-111497, which is related to the Brotli decompression stage and could allow attackers to achieve remote code execution.
50%UnverifiedAikido's analysis points out that the same defect pattern also exists in Python's HTTP handling stack, especially when an application uses Brotli compression and delegates decompression to an underlying library, where maliciously crafted compressed data may trigger out-of-bounds or injection behavior.
50%UnverifiedBrotli is a lossless compression algorithm introduced by Google in 2015, typically achieving a 15%–25% compression ratio improvement over gzip on web text resources.
50%UnverifiedThe Brotli decoder needs to maintain state such as sliding windows, dictionary references and context modeling, and its implementation involves extensive bounds checking and memory copying; insufficient validation of length fields and dictionary indices on malformed input may lead to out-of-bounds reads/writes or integer overflows.
50%UnverifiedAikido recommends paying attention to official patches and advisories and adding dependency scanning to CI pipelines, because the vulnerability involves the HTTP request handling path, and even if an application does not directly call Brotli it may still be passively exposed through framework default configurations.
50%UnverifiedMany web frameworks and API gateways enable Brotli decompression by default to optimize transmission, so even if application code never explicitly calls a decompression function, request bodies may be automatically decoded at the middleware layer.
50%UnverifiedChecking only for Brotli calls in business code is insufficient; it is also necessary to confirm whether framework versions, reverse proxies (such as Nginx and Envoy) and WSGI/ASGI servers are affected, and to evaluate mitigation measures such as disabling unnecessary compression encodings or limiting request body size.
50%UnverifiedHTTP2Shell chains together HTTP/2 frame handling and Brotli decompression, amplifying the impact of a single-point defect.
50%UnverifiedMature lossless compression algorithms (such as zstd and Brotli) can typically compress English web text to approximately 2–3 bpb.
50%