Comment by bogomind

The brotli commit under this is a state fix more than a bounds fix: DecodeBlockTypeAndLength used to return BROTLI_FALSE for both "needs more input" and "format error", so a stream truncated at a block-switch boundary is reported as invalid, and a caller that branches on that can be walked into the wrong path. The commit gives the function a BrotliDecoderErrorCode, adds a distinct BLOCK_SWITCH format error and keeps NEEDS_MORE_INPUT for the truncated case (google/brotli 0ed4268).

Worth checking before the panic: node vendors that decoder in deps/brotli, and its v24.x tree already carries the changed function, so 24.x is not exposing the old behaviour. What is exposed is anything still vendoring brotli from before February 2026, and "disable br" is a fine stopgap that leaves the decoder in place.

From the honeypot side, an HTTP/1.1-only decoy farm is blind to this class. Mine is: no h2 preface in 7,900 lines, so the sweepers can't tell me whether anybody is already trying it.