Organizations now have to trace a critical Brotli decoder issue through cloud runtimes, developer stacks, and products that bundle the library. Crafted compressed input can cause memory corruption, expose process memory, crash services, or allow code execution without authentication. The issue is listed as known exploited and affects technologies including Node.js, .NET, PowerShell, Envoy Proxy, Istio, Bun, and Python packages. AWS and Broadcom have published product-specific actions, with some fixes still rolling out.
What Happened
A critical out-of-bounds write in the Google Brotli decoder can be triggered remotely without authentication by sending specially crafted compressed data. Successful exploitation could corrupt memory, disclose sensitive process information, crash an affected service, or permit arbitrary code execution. The issue was added to the Known Exploited Vulnerabilities catalog on October 27, making exposure assessment and remediation an active priority rather than a theoretical exercise. Brotli is an open-source compression technology used to reduce the size of web content, but its reach extends through products, programming runtimes, proxies, service infrastructure, and software packages that bundle or depend on the decoder. The affected technology list in the supplied alert includes Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages. AWS said the underlying issue affects Brotli decoding beyond Node.js and that fixes from other vendors were not yet fully available. Cloud exposure varies by service and customer configuration. AWS said the Lambda managed service itself is not affected, while the .NET and Node.js Lambda runtimes are affected. Patched runtime deployment is occurring in phases, and customers must update function code or configuration after the relevant patched runtime arrives; a zero-change update is not enough. App Runner’s managed Node.js runtime was updated across all AWS Regions on October 26, but services that have not been deployed since then need to be redeployed. Broadcom separately assessed the issue as critical for SDDC Manager 9.1.1.x and directed customers to apply the listed patches.
Why It Matters
This is a dependency-discovery problem as much as a patching problem. Organizations may not knowingly deploy Brotli as a standalone component, yet still process Brotli-compressed input through a runtime, cloud function, proxy, application package, or vendor product. That can make ownership unclear and allow vulnerable copies to remain outside a traditional server inventory. The cloud details also show why a provider update does not always complete customer remediation. A managed platform may deploy a corrected runtime, but an existing function or service can still require a configuration change, code update, runtime migration, or redeployment before it uses the fix. Business risk therefore depends on both vendor availability and the organization’s ability to identify owners, test changes, and move workloads promptly. Because exploitation has been reported, delayed dependency mapping leaves externally reachable decoding paths exposed while teams wait for a complete product list.
What to Watch
Organizations should watch vendor bulletins for products that embed Brotli because fixes were not yet fully available across the ecosystem. AWS customers should follow the regional runtime rollout and service-specific instructions rather than assuming every workload updates in the same way. Additional guidance was still pending for some services, including the Python Selenium canary runtime. Teams should also watch for fixed releases from language, framework, proxy, and appliance vendors and reassess exposure when those vendors clarify whether their products decode untrusted Brotli input.
What Defenders Should Do
Discovery: identify applications, runtimes, containers, functions, proxies, service meshes, packages, and vendor products that include Brotli decoding. Include both direct dependencies and components bundled by another platform or product. Prioritization: focus first on internet-reachable or network-accessible services that process untrusted compressed input, along with items already identified as affected by their vendors. Remediation: update to fixed releases and follow product-specific instructions. For customer-managed Node.js environments on AWS, the bulletin lists Node.js 22.23.4, 24.22.1, 26.12.1, or later. For affected Lambda runtimes, make a code or configuration change after the patched runtime is available because a zero-change update will not pick it up. Redeploy App Runner services that have not been deployed since October 26, and update an older pinned runtime before redeployment. For SDDC Manager 9.1.1.x, use Broadcom’s response matrix and apply the listed patches. Temporary mitigation: where immediate updating is impossible, AWS describes a Web Application Firewall rule that can detect and block inbound requests using Brotli content encoding. Test the rule in count mode before blocking because disabling compressed input can affect legitimate traffic. Verification: confirm the running version after deployment and document which team owns each remaining exception.
The Larger Lesson
Widely reused components create risk that crosses the boundaries between applications, cloud services, infrastructure products, and development ecosystems. Remediation cannot stop at asking whether the organization installed a named library. Teams need visibility into what their software and managed services contain, what input those components process, and whether a provider-side fix requires customer action. The durable capability is not merely faster patching. It is dependable dependency ownership combined with the ability to redeploy affected workloads quickly.