A critical bug in the Brotli decompression code used by Node.js, .NET, Python tools and more is now being attacked.