Node.js says the Brotli decoder ‘kept appending input bytes to an eight-byte internal buffer’. Microsoft has now patched .NET ...
The HTTP2Shell Brotli flaw also impacts .NET, FFmpeg, ClickHouse, and Apache Arrow, so updating Node.js alone may leave other vulnerable applications exposed.