A Brotli Decoder Treated a Bad Block Switch as 'Send More Bytes', and Kept Writing Past an 8-Byte Buffer

Mon, 26 Oct 2026 08:30:00 +0530

The Brotli bug disclosed on 21 October is not an integer overflow or a bad length field. According to the Node.js advisory, malformed input made the streaming decoder write past the end of an eight-byte internal buffer because “an invalid block switch was reported as a temporary need for more input rather than a permanent format error.” A permanent error should end the stream. A temporary one tells the caller to supply more bytes and call again, so the decoder kept appending whatever it was given.

Compression on Kuldeep Pisda

A Brotli Decoder Treated a Bad Block Switch as 'Send More Bytes', and Kept Writing Past an 8-Byte Buffer