A flaw in the reference C Brotli decoder lets a crafted stream write past an eight-byte buffer, enabling memory leaks or code execution in Node.js, Python packages and other software that bundles it. Fixes are in Brotli 1.2.1 and patched Node.js releases, and the article lists affected projects, checks and mitigations.

— via Hacker News (top 30), theanonymousone