Based on the technical write-ups published this week by Imperva, Upwind and the Node.js project, plus CISA’s Oct 27 KEV alert, here is the architectural impact.

The bug is in DecodeBlockTypeAndLength(). It returned a boolean, so “malformed” and “need more input” were indistinguishable, and the fast path ignored the result. Exposure depends on whether attacker-controlled bytes reach the decoder. That means request bodies with Content-Encoding: br, responses your service fetches (webhooks, link previews), or direct decompression of uploads. A WAF only covers the first.

Imperva has code execution on stock Node.js 24.22.0 arm64, not on every attempt. Others argue DoS only. CISA hasn’t said which outcome it saw.

For people running Envoy, Python requests/httpx or Node fetch() in prod: how are you inventorying bundled Brotli copies? Version strings don’t help, since one analysis says Node 24.22.0 and the fixed 24.22.1 both report Brotli 1.2.0.

Background on the same failure class: https://www.techgines.com/post/lmcache-vulnerability-cve-2026-105192