π’ You can Just Use Rust and Stop Getting Pwned π’
Node -C +π¦ = node2shell fixed:
git clone https://github.com/hoshinolina/rust-brotli-decompressor &&
cd rust-brotli-decompressor/c &&
make &&
cp target/release/libbrotli_decompressor.so /lib64 &&
ln -nsf libbrotli_decompressor.so /lib64/libbrotlidec.so.1
Works on Fedora 44 with system node.js v24.
Disclaimer: This is a PoC of how this whole CVE could have been avoided. I stubbed out the brotli metadata support because it was missing that symbol and it's probably useless for HTTP anyway.
rust-brotli-decompressor by Dropbox.
Use Rust, people.
And yes, I verified that node is really calling into the Rust Brotli decoder in my system. YMMV on other builds of Node.
Python usually uses static libbrotli and this would not fix that one, you'd have to link it against the Rust version explicitly.