This one again feels overblown, at least for servers. I just checked an org of over 200 GitHub repos. Node, Python, and C#. None of them are vulnerable... because none of them actually call the Brotli decoder. It's just not enabled by default on the server side, by the platforms themselves. This is much like the PHP bugs, where specific conditions have to be in play before you're actually vulnerable.

For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.

(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)

Doesn't node's fetch call the decoder automatically for `br` responses? So any attacker controlled content that a server fetch's may be vulnerable?

How did you check? Is there are PoC or some kind of command to run?

I mean, I dare say the 4,200,000 Python servers built yesterday alone with this package might disagree...? https://pypistats.org/packages/brotli

I can't find download numbers for extras, but it comes in the pretty dang innocuous-seeming `aiohttp[speedups]`, as well. Also `urllib3[brotli]`. Many, many people will be running these servers without recognizing the name of the library, especially in the agentic era.

I might be missing something obvious in your message, cause I don't see why server/client is relevant. Why would a frontend app speak a protocol that the backend doesn't?