XS::libbrotli versions before 1.2.1.0 include a bundled brotli library with an out-of-bounds write vulnerability in the decoder. This flaw allows an attacker to supply crafted brotli streams that can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. The vulnerability is fixed in version 1.2.1.0, which updates the bundled brotli library to version 1.2.1. Upgrading the system brotli library does not mitigate this issue because the vulnerable library is statically linked.