The advisory says that applications which decode attacker-controlled Brotli data may be exposed to crashes, memory disclosure, or remote code execution. It identifies compressed HTTP requests, responses fetched from untrusted servers, and compressed files as relevant input paths.
Listed fixed releases include Node.js 22.23.4, 24.22.1, and 26.12.1; Bun 1.4.4; Envoy Proxy 1.40.0, 1.39.3, 1.38.6, and 1.37.8; and Istio 1.29.9, 1.30.6, and 1.31.2. For the upstream library, the page lists Brotli 1.0.10, 1.1.1, and 1.2.1. It says the fixed-release list was reviewed on October 23, 2026.
Until an update is deployed, the advisory recommends disabling Brotli decoding of untrusted data while retaining other compression formats where possible. It specifically notes that removing br from an HTTP Accept-Encoding header alone does not prevent a server from sending Brotli content.
The source does not establish which deployments are vulnerable, whether exploitation has occurred, or the prevalence of affected embedded and downstream copies of the decoder.