RUSTSEC-2026-0455: Large-window Brotli bodies bypass decompression memory limits

With the compress-brotli feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurrent requests can exhaust process or host memory.

Actix Web enables Brotli support by default. Applications that read request bodies through Bytes, String, Json, or Form can be affected even when extractor size limits are configured. The allocation occurs before the handler runs, so authentication performed in the handler does not prevent it.

Upgrade to actix-http 3.20.3 or later. As a workaround, reject requests with Content-Encoding: br at a reverse proxy or in middleware before body extraction, or disable the compress-brotli feature throughout the dependency graph.