Bye Bye Brotli? Google's Compression Library Is a Security Mess
vanschelven
28 points
7 comments
October 25, 2026
Related Discussions
Found 5 related stories in 166.5ms across 10,559 title embeddings via pgvector HNSW
- Brotli vulnerability affects curl and Git bmitch3020 · 27 pts · October 23, 2026 · 58% similar
- Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) khaled_ismaeel · 15 pts · October 22, 2026 · 58% similar
- Node.js Brotli RCE (CVE-2026-111497) nthypes · 16 pts · October 21, 2026 · 57% similar
- Goodbye Google Murmuring9087 · 52 pts · September 25, 2026 · 54% similar
- This Code Is CRAP (2011) luispa · 74 pts · September 16, 2026 · 47% similar
Discussion Highlights (2 comments)
vanschelven
Author here, happy to discuss. I also constructed (with agentic help) this absolute mess of a timeline (linked in the article, but I think interesting on its own): https://www.bugsink.com/blog/http2shell-timeline/
runningmike
Source https://github.com/google/brotli for who wants to do a real security audit. Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!