Back to the trend of the day: PHP updates Windows web tools to fix a flaw that could let attackers run code
Poly Rating · from the trend of the day

Algorithm for Data Compression: Top 10 Web Codecs 2026

Zstandard decompresses 3.6 times faster than Brotli (1,550 vs 425 MB/s) for a 0.4% ratio gap, and in October 2026 it was Brotli's decoder that shipped a remote out-of-bounds write rated 9.8.

  • No. 1: Zstandard (zstd)
  • 10 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    Zstandard (zstd)

    Decodes at 1,550 MB/s vs Brotli's 425, at near-equal ratio (2.896 vs 2.883). Its few CVEs hit the command-line tool, not the decoder. On web assets Brotli still wins, 3.08 vs 2.86.

    Included it: Meta, Grok, Gemini, Nova, StepFun, Kimi, DeepSeek, Qwen. Did not include: ChatGPT, Wenxin.

    In their lists: Meta: see list · Grok: see list · Gemini: see list · Nova: 1 · StepFun: see list · Kimi: see list · DeepSeek: see list · Qwen: see list

    What each AI noted 8
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grok

      Named differently in its own list: open the full list.

      see list
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • Novaplace 1

      Decompresses at 200-400 MB/s while achieving 2.5-3.5x compression ratio, but its 2026 stream-validation flaw raised DoS risks.

      Source ↗
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    8 AIs put it here
    Source ↗
  2. 2

    gzip / DEFLATE (zlib)

    Still compresses 60% of web JavaScript, against Brotli's 29%. It decodes at 390 MB/s with a 2.743 ratio, and its zlib decoder carries 19 CVEs, including CVE-2022-37434 rated 9.8.

    Included it: Meta, Grok, Gemini, Nova, StepFun, Kimi, DeepSeek, Qwen. Did not include: ChatGPT, Wenxin.

    In their lists: Meta: 2 · Grok: 2 · Gemini: 2 · Nova: 3 · StepFun: 2 · Kimi: 2 · DeepSeek: 2 · Qwen: 1

    What each AI noted 8
    • Metaplace 2

      82% of sites serve gzip via zlib – in PHP, Python gzip, Node zlib, Ruby Zlib, every Nginx build – CVE-2022-37434 heap overflow via large gzip header extra field

    • Grokplace 2

      Linked into nearly every language runtime and web server; a handful of critical heap overflows (including 2022 and 2026) still surface despite decades of auditing.

    • Geminiplace 2

      Silently linked into Node.js, Python, and PHP runtimes alike, leaving 47.1% of HTTP server responses dependent on a 30-year-old memory model.

    • Novaplace 3

      The web's original compressor, still handling 80% of HTTP traffic at 1.5-2x ratio but plagued by historic zlib flaws.

      Source ↗
    • StepFunplace 2

      19 CVEs, and an inflate() heap overflow that sat in the default HTTP gzip path all the way through 1.2.12.

    • Kimiplace 2

      Bundled into PHP, Node, Python and curl — and even linked inside OpenSSL itself; its worst inflate() bug scored 9.8.

    • DeepSeekplace 2

      19 CVEs since 2002, 9 with public exploits, and a CVSS 9.8 heap overflow in inflate — the decompressor behind gzip, PNG, and countless HTTP stacks.

    • Qwenplace 1

      The invisible lung of the internet, compressing 90% of web traffic while quietly dropping memory corruption CVEs every few years.

      Source ↗
    8 AIs put it here
    Source ↗
  3. 3

    LZ4

    The fastest decoder at 3,850 MB/s, but only a 2.101 ratio, which means bigger payloads than zstd. Some AIs claimed zero CVEs, yet CVE-2021-3520 is a real integer overflow causing memory corruption.

    Included it: Meta, Grok, Gemini, Nova, StepFun, Kimi, DeepSeek, Qwen. Did not include: ChatGPT, Wenxin.

    In their lists: Meta: see list · Grok: see list · Gemini: see list · Nova: 4 · StepFun: see list · Kimi: see list · DeepSeek: see list · Qwen: see list

    What each AI noted 8
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grok

      Named differently in its own list: open the full list.

      see list
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • Novaplace 4

      Fastest decompressor at 500+ MB/s but only 1.5-2x ratio; its simplicity avoids complex vulnerabilities seen in Brotli/Zstd.

      Source ↗
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    8 AIs put it here
    Source ↗
  4. 4

    Brotli

    Tightest on web text: 3.08:1 vs gzip's 2.56 on Cloudflare's assets, and 19% smaller at level 11. The price is CVE-2026-111497, an out-of-bounds write rated 9.8 across versions 1.0.3 to 1.2.0.

    Included it: Meta, Grok, Gemini, Nova, StepFun, Kimi, DeepSeek, Qwen. Did not include: ChatGPT, Wenxin.

    In their lists: Meta: 7 · Grok: 5 · Gemini: 9 · Nova: 2 · StepFun: 7 · Kimi: 9 · DeepSeek: see list · Qwen: see list

    What each AI noted 8
    • Metaplace 7

      Vendored C decoder in Node zlib, Bun, Python brotli, PHP Windows builds 8.2-8.5 – CVE-2026-111497 Node2Shell/HTTP2Shell RCE across all ecosystems

      Source ↗
    • Grokplace 5

      The very library that forced emergency Windows PHP rebuilds on 26 October 2026; one critical decoder OOB-write rippled through Node, Python, .NET and PHP.

      Source ↗
    • Geminiplace 9

      Bundled natively into PHP and Node.js for rapid stream decoding, where an October 2026 out-of-bounds write forced urgent multi-version binary rebuilds.

      Source ↗
    • Novaplace 2

      Google's 4-5x ratio compressor used in PHP 8.2+, but CVE-2026-111497 turned decompression into an RCE vector.

    • StepFunplace 7

      The newest entry on this list, and the only one that got a remote-code-execution bug in a bundled decoder across Node.js, Bun, PHP and Python at the same moment.

    • Kimiplace 9

      The youngest library here and already a live unauthenticated RCE — the exact 'ingress decompression' pattern, straight from the context story.

    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    8 AIs put it here
    Source ↗
  5. 5

    Snappy

    Decodes at 1,500 MB/s with a 2.089 ratio and skips Huffman coding entirely. Its known CVE (CVE-2023-43642) sits in the snappy-java wrapper, not the C++ core.

    Included it: Meta, Grok, Gemini, StepFun, Kimi, DeepSeek, Wenxin, Qwen. Did not include: ChatGPT, Nova.

    In their lists: Meta: see list · Grok: see list · Gemini: see list · StepFun: see list · Kimi: see list · DeepSeek: see list · Wenxin: see list · Qwen: see list

    What each AI noted 8
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grok

      Named differently in its own list: open the full list.

      see list
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    • Wenxin

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    8 AIs put it here
    Source ↗
  6. 6

    XZ / LZMA

    Highest ratio here (3.43 in a kernel SquashFS test) but only 35 MB/s decode. Its worst CVE, the 10.0-rated CVE-2024-3094, was a planted backdoor, not a parsing bug.

    Included it: Meta, Grok, Gemini, StepFun, Kimi, DeepSeek, Wenxin, Qwen. Did not include: ChatGPT, Nova.

    In their lists: Meta: see list · Grok: see list · Gemini: see list · StepFun: see list · Kimi: see list · DeepSeek: see list · Wenxin: see list · Qwen: see list

    What each AI noted 8
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grok

      Named differently in its own list: open the full list.

      see list
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    • Wenxin

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    8 AIs put it here
    Source ↗
  7. 7

    bzip2

    Decodes at 34–90 MB/s depending on the test, too slow for live HTTP. Its 2019 out-of-bounds write (CVE-2019-12900) scores 9.8 at NVD but 4.4 at Red Hat.

    Included it: Meta, Grok, Gemini, StepFun, Kimi, DeepSeek, Wenxin, Qwen. Did not include: ChatGPT, Nova.

    In their lists: Meta: see list · Grok: see list · Gemini: see list · StepFun: see list · Kimi: see list · DeepSeek: see list · Wenxin: see list · Qwen: see list

    What each AI noted 8
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grok

      Named differently in its own list: open the full list.

      see list
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    • Wenxin

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    8 AIs put it here
    Source ↗
  8. 8

    LZO

    Built for real-time decoding: 217 MB/s and a 2.64 ratio in a SquashFS test, with 780 MB/s claimed elsewhere. Its 2014 integer overflow (CVE-2014-4607) showed how badly old fast C code ages.

    Included it: Meta, Grok, Gemini, StepFun, DeepSeek. Did not include: ChatGPT, Nova, Kimi, Wenxin, Qwen.

    In their lists: Meta: see list · Grok: see list · Gemini: see list · StepFun: see list · DeepSeek: see list

    What each AI noted 5
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grok

      Named differently in its own list: open the full list.

      see list
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • DeepSeek

      Named differently in its own list: open the full list.

      see list
    5 AIs put it here
    Source ↗
  9. 9

    Zopfli

    Makes DEFLATE output 3–8% smaller at roughly 81–100 times the compression time. It adds no decoder attack surface, because any gzip client can read its output.

    Included it: StepFun, Kimi, Qwen. Did not include: ChatGPT, Meta, Grok, Gemini, Nova, DeepSeek, Wenxin.

    In their lists: StepFun: see list · Kimi: see list · Qwen: see list

    What each AI noted 3
    • StepFun

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    • Qwen

      Named differently in its own list: open the full list.

      see list
    3 AIs put it here
    Source ↗
  10. 10

    LZW (Unix compress)

    The 1980s dictionary coder behind Unix compress and GIF. Its patent expired on June 20, 2003, and browsers never decoded it natively, so it brings no network gain today.

    Included it: Meta, Kimi. Did not include: ChatGPT, Grok, Gemini, Nova, StepFun, DeepSeek, Wenxin, Qwen.

    In their lists: Meta: see list · Kimi: see list

    What each AI noted 2
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Kimi

      Named differently in its own list: open the full list.

      see list
    2 AIs put it here
    Source ↗

More about the top three ↓

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

The three are ranked on a mix of ratio, decode speed and decoder bugs, so speed alone does not set the order: LZ4 decodes fastest but ranks third. Speed and ratio come from the same Silesia test, while the web-share figures (60% against 29%) measure something

1Zstandard (zstd)

No. 1 — Zstandard (zstd). On the lists of 8 of 10 AIs; median place there: 1. Decodes about 3.6 times faster than Brotli at nearly the same ratio, and its few bugs sit outside the decoder.

Did you know

  • In 2018 Canonical tested zstd level 19 on Ubuntu .deb packages. Decompression was much faster than xz, but the packages were about 6% larger. Arch Linux later said its zstd switch made decompression 14 times faster, with a 0.8% size increase.

    Source ↗
What it is
A fast compression tool released by Facebook (Meta) in 2016.
Its edge
Decodes 3.6 times faster than Brotli, with almost the same ratio.
Who it suits
Suits servers that want speed and small files; weaker where browsers or CDNs lack support.
  • Decoder speed and ratio1,550 MB/s decode, ratio 2.896

Wikipedia · Wikidata

Why it is here

  • In the official lzbench test on the Silesia corpus, zstd 1.5.7 unpacks data at 1550 MB/s. Brotli 1.1.0 manages 425 MB/s and zlib 390 MB/s. That is about 3.6 times faster than Brotli.

    Source ↗

  • The same table gives zstd the best ratio: 2.896. Brotli is at 2.883, zlib at 2.743, LZ4 at 2.101 and Snappy at 2.089. It compresses at 510 MB/s, against Brotli's 290 and zlib's 105.

    Source ↗
Did you know

  • Zstandard can go below level 1. Its levels run from negative 7, the fastest, up to 22, the strongest but slowest to compress. So one tool covers both quick, light squeezing and very heavy squeezing.

    Source ↗
History

  • In 2016 Facebook (now Meta) released Zstandard 1.0 under a BSD license. It was built to be faster than Deflate, the method behind zip and gzip that had given a strong balance of speed and size for two decades.

    Source ↗
Keep in mind

  • For files that are saved once and served many times, Brotli at level 11 still made the smallest files in one test. Zstd at level 19 compressed about four times faster, though.

    Source ↗

  • Browser support is newer. Chrome added zstd in version 123 (2024). In the Chromium discussion, Firefox's engine (Gecko) had given no signal yet, and many CDNs were slow to follow.

    Source ↗
What people say

  • Brotli appears to outperform zStandard in both compression ratio and compression time up until level 9 for this response. — Paul Calvano

    Source ↗
Where to go further

  • Open the README and jump to its Benchmarks heading. Compare the zstd rows with the Brotli, zlib and LZ4 rows, and watch how fast zstd decodes next to its compression ratio.

    Source ↗
Compare the top three ↓

2gzip / DEFLATE (zlib)

No. 2 — gzip / DEFLATE (zlib). On the lists of 8 of 10 AIs; median place there: 2. Still compresses most web JavaScript and runs everywhere, but it decodes slowest of the three and has a critical decoder bug.

Did you know

  • Mark Adler wrote zlib's decompression code with Jean-loup Gailly, who wrote the compression. Adler also worked on NASA's Mars Exploration Rover mission, leading a study on the concept that was later selected for the 2003 mission.

    Source ↗
What it is
The classic gzip method, built into nearly every language and web server.
Its edge
Most widely used: it compresses 60% of web JavaScript, Brotli only 29%.
Who it suits
Suits legacy systems that must work everywhere; a poor pick for speed or small files.
  • Decoder speed and ratio390 MB/s decode, ratio 2.743

Wikipedia · Wikidata

Why it is here

  • zlib 1.3.1 is the slowest and weakest of the three on the official Silesia test. It decompresses at 390 MB/s, against zstd's 1550. It compresses at 105 MB/s with a 2.743 ratio.

    Source ↗

  • zlib's decoder (inflate) has a serious bug, CVE-2022-37434, in zlib up to 1.2.12. A large gzip header field can cause a buffer overflow. It is rated 9.8 (Critical), and only programs that call inflateGetHeader are affected.

    Source ↗
History

  • zlib's first public version, 0.9, came out on 1 May 1995. It was originally intended for the libpng image library, and Jean-loup Gailly and Mark Adler wrote it.

    Source ↗
Qwen put it first. What they saw in it

  • Qwen: The invisible lung of the internet, compressing 90% of web traffic while quietly dropping memory corruption CVEs every few years.

Compare the top three ↓

3LZ4

No. 3 — LZ4. On the lists of 8 of 10 AIs; median place there: 4. Fastest decoder by far, but its low ratio means bigger files, and it has a real decoder bug.

Did you know

  • LZ4 is built into the Linux kernel since version 3.11. FreeBSD, Illumos, ZFS on Linux and ZFS-OSX also use it for on-the-fly compression in their ZFS filesystems.

    Source ↗
What it is
A very simple compressor made for speed, released in 2011.
Its edge
Decodes at 3,850 MB/s, about 2.5 times faster than zstd.
Who it suits
Suits jobs where speed beats size; not for sending files over the web.
  • Decoder speed and ratio3,850 MB/s decode, ratio 2.101

Wikipedia · Wikidata

Why it is here

  • LZ4 1.10.0 decompresses at 3850 MB/s, the fastest in the official Silesia test. That is about 2.5 times zstd's 1550 MB/s. The cost is a 2.101 ratio, against zstd's 2.896, so files stay bigger.

    Source ↗

  • LZ4 does have a decoder flaw, CVE-2021-3520. A crafted file can cause an integer overflow and an out-of-bounds write. NVD scores it 9.8, while Red Hat scores it 8.6.

    Source ↗ ✓ confirmed by several AIs
Did you know

  • LZ4 has no entropy coding step, unlike DEFLATE, which uses Huffman coding. Each piece of data starts with a one-byte token. It is split into two 4-bit halves, one for literal count and one for match length.

    Source ↗
History

  • In 2011 Yann Collet released LZ4 just a week or two after Google open-sourced Snappy, a similar fast compressor. LZ4 went on to beat Snappy on speed.

    Source ↗
What people say

  • I could only see an `acceleration` value to tune in the `lz4.h` file, which would allow me to make LZ4 even faster — ahf

    Source ↗
Where to go further

  • Open the README at its Benchmarks heading. See how LZ4 decodes fastest, then look at its compression ratio. That smaller ratio is the trade-off: bigger files to send over the web.

    Source ↗

Video: LZ4 Compression fixed all my issues! Here's how to do it (PS5 13.60 Relapse Jailbreak) · Adam LaPrade

Compare the top three ↓

The top three side by side

Zstandard (zstd)gzip / DEFLATE (zlib)LZ4
In the AIs' lists8 / 108 / 108 / 10
Decoder speed and ratio1,550 MB/s decode, ratio 2.896390 MB/s decode, ratio 2.7433,850 MB/s decode, ratio 2.101
Put first byNovaQwen—

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

The zstd vs Brotli ratio gap depends on the corpus: 0.4% on Silesia (2.896 vs 2.883) but 7% on Cloudflare's web assets (2.86 vs 3.08), where Brotli's built-in web dictionary helps.

Noticed by:
Included it: Meta, Grok, StepFun, DeepSeek. Did not include: ChatGPT, Gemini, Nova, Kimi, Wenxin, Qwen.
Source ↗

Going from Brotli level 1 to level 11 lifts the ratio from 2.53 to 3.88 on enwik8, while compression speed falls from 111.72 MB/s to 0.35 MB/s.

Noticed by:
Included it: ChatGPT. Did not include: Meta, Grok, Gemini, Nova, StepFun, Kimi, DeepSeek, Wenxin, Qwen.
Source ↗

CVE-2026-111497 hit every Brotli release from 1.0.3 to 1.2.0 on all platforms. It reached runtimes through copies bundled in Node.js, Bun, PHP and Python packages.

Noticed by:
Included it: Meta, Grok, StepFun, Kimi. Did not include: ChatGPT, Gemini, Nova, DeepSeek, Wenxin, Qwen.
Source ↗

MB/s figures disagree from test to test: the zstd table says 1,550 vs 425 MB/s for zstd vs Brotli, while zstd's maintainer reports roughly 700 vs 500 MB/s on web pages.

Noticed by:
Included it: Meta, StepFun, DeepSeek. Did not include: ChatGPT, Grok, Gemini, Nova, Kimi, Wenxin, Qwen.
Source ↗

04Questions people ask

What is a compression algorithm?

A method that stores data in fewer bits by removing redundancy. Lossless codecs such as zstd shrink the Silesia test corpus by a ratio of 2.896 and restore it exactly.

Source ↗
How do compression algorithms work?

They replace repeated strings with back-references (LZ77), then entropy-code the result with Huffman or FSE. Brotli also uses a built-in dictionary of about 120 KB of common web fragments.

What is the most powerful compression algorithm?

For ratio, LZMA/xz and Brotli at maximum settings. Brotli level 11 reaches 3.88:1 on enwik8, but it compresses at only 0.35 MB/s.

Why do compression benchmarks disagree?

Results shift with corpus, level and machine. The same zstd vs Brotli decoding pair measures 1,550 vs 425 MB/s in one test and about 700 vs 500 MB/s in another.

Source ↗

05How we counted

In plain words, no formulas.

1The question

Top 10 Web Data Compression Algorithms by Network Efficiency vs. Memory Attack Surface

2Where it applies

global web standards and network protocol engineering

3What we looked at

  • Decompression speed and transfer payload reduction over raw HTTP payloads
  • Structural parsing complexity and historical vulnerability density in reference C decoders
  • Zstandard official benchmark (lzbench, Silesia corpus, i7-9700K) — Compression ratio and compression/decompression speed in MB/s for zstd, Brotli, zlib, LZ4 and Snappy
  • Cloudflare web-assets test (via OpenReplay) — Average compression ratio on real web assets: gzip 2.56, zstd 2.86, Brotli 3.08
  • HTTP Archive Web Almanac 2024 — Which codec actually compresses crawled web responses
  • NIST NVD / OpenCVE — Memory-corruption and DoS CVEs in each codec's reference C decoder

4Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: ChatGPT, Meta, Grok, Gemini, Nova, StepFun, Kimi, DeepSeek, Wenxin, Qwen.

5How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

06Each AI's own list

🇺🇸 ChatGPT10 places · 3 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    Brotli (br)

    The web-oriented winner has an uncomfortable footnote: one malformed stream exposed a decoder flaw rated CVSS 3.1 9.8.

  2. 2
    Zstandard (zstd)

    A fast modern alternative can decode at nearly 479 MiB/s in one published corpus test, though that is not an HTTP-specific guarantee.

  3. 3
    Gzip / DEFLATE

    The compatibility champion remains compelling: in one text benchmark, gzip -6 and zstd 3 produced the same 1.48 MB output, but zstd finished compression faster.

  4. 4
    LZ4

    In one mixed-corpus test, LZ4 decoded at 742.106 MiB/s, illustrating the appeal of speed when bandwidth savings are secondary.

    Source ↗
  5. 5
    Snappy

    Snappy prioritizes decompression speed and simple integration over squeezing every last byte from a payload.

    Source ↗
  6. 6
    Deflate (raw DEFLATE stream)

    Removing the gzip wrapper does not change the underlying DEFLATE coding, but it changes the framing contract and interoperability expectations.

  7. 7
    LZMA / XZ

    The ratio can be excellent, but one published text test took 1,771 ms to compress 10.07 MB with xz -6.

  8. 8
    Bzip2

    Its block-sorting approach can improve size over gzip on some corpora, but the decoder is much slower than modern fast codecs in the cited test.

  9. 9
    LZHAM

    Its presence in broad codec comparisons makes it a useful high-compression reference point, but it is not a default HTTP content-coding choice.

    Source ↗
  10. 10
    LZHAM / LZMA-family high-compression modes

    At the extreme end, extra ratio often costs disproportionately more encoder time and memory, making it a poor default for latency-sensitive web responses.

    Source ↗

What ChatGPT noticed

Zstandard and LZ4 can be attractive when CPU cost matters: the cited mixed-corpus test reports 478.733 MiB/s decompression for zstd and 742.106 MiB/s for LZ4, with LZ4 delivering a worse compression ratio in that test.

Source ↗

The October 2026 Brotli incident is a reminder that the encoder's compression ratio says nothing about whether the decoder safely rejects malformed input.

Source ↗

A decompression algorithm's risk is not captured by CVE count alone: a single root-cause decoder bug can affect many language packages, while denial-of-service issues and memory-corruption issues have different consequences.

Source ↗
🇺🇸 Meta10 places

The same question, answered by Meta alone. The final list above combines all the AIs.

  1. 1
    OpenSSL (libssl, libcrypto)

    Bundled in Node.js, Python, PHP 8.x, .NET 8/9/10 – 69.3% PHP web still runs on it, 14 vulns patched Sept 2026 including CVE-2026-84782 CVSS 8.2 DTLS heap leak

  2. 2
    zlib (libz)

    82% of sites serve gzip via zlib – in PHP, Python gzip, Node zlib, Ruby Zlib, every Nginx build – CVE-2022-37434 heap overflow via large gzip header extra field

  3. 3
    libcurl

    Powers PHP cURL + CURLOPT_ENCODING auto-decompress that triggered Brotli RCE, Guzzle sets "" by default – 33 CVEs in SBOM scan, 6 critical per audit

    Source ↗
  4. 4
    libxml2

    XML parser in PHP DOM, Python lxml, .NET – 17 vulns in 2.9.10 per cvedetails, 4 DoS in Ubuntu USN-7974-1 CVE-2025-8732, CVE-2026-0989/0990/0992

  5. 5
    PCRE / PCRE2 (libpcre)

    Regex engine behind PHP preg_, Python re, Nginx – CVE-2007-1660 buffer overflow via multiple forms of character class, CVE-2008-2371 heap overflow in pcre_compile

  6. 6
    SQLite (libsqlite3)

    Embedded DB in PHP PDO, Python sqlite3, Node sqlite – CVE-2026-51297 use-after-free JSON parsing RCE, CVE-2019-5018 CVSS 8.1 remote via crafted SQL

  7. 7
    Brotli (libbrotlidec / libbrotlienc)

    Vendored C decoder in Node zlib, Bun, Python brotli, PHP Windows builds 8.2-8.5 – CVE-2026-111497 Node2Shell/HTTP2Shell RCE across all ecosystems

    Source ↗
  8. 8
    libpng

    PNG decoder in PHP GD, Python Pillow, .NET System.Drawing – 5 CVEs in Oct 2025 batch CVE-2025-64505/64506/64720/65018/66293 heap overflow

    Source ↗
  9. 9
    libjpeg-turbo

    JPEG codec in PHP GD, Python Pillow, Node sharp – CVE-2018-20330 integer overflow heap overflow in tjLoadImage via BMP pitchheight

  10. 10
    Expat (libexpat)

    XML parser in Python xml.parsers.expat, Node xml2js, PHP XML – CVE-2022-40674 heap use-after-free, CVE-2023-52426 etc, powers RSS/Atom feeds

🇺🇸 Grok10 places · 1 notes

The same question, answered by Grok alone. The final list above combines all the AIs.

  1. 1
    OpenSSL

    The cryptographic workhorse behind virtually every HTTPS connection; 110+ tracked CVEs with a steady stream of high-severity memory issues even in 2026.

  2. 2
    zlib

    Linked into nearly every language runtime and web server; a handful of critical heap overflows (including 2022 and 2026) still surface despite decades of auditing.

  3. 3
    libcurl

    The HTTP client library embedded in PHP, Python, many Node add-ons and countless backends; continuous stream of memory-safety CVEs, some reaching high severity in 2026.

  4. 4
    libxml2

    XML parsing core for PHP, Python, many Java and Ruby stacks; persistent source of use-after-free and buffer issues that regularly score CVSS 7–9.

  5. 5
    Brotli (libbrotli)

    The very library that forced emergency Windows PHP rebuilds on 26 October 2026; one critical decoder OOB-write rippled through Node, Python, .NET and PHP.

    Source ↗
  6. 6
    libpng

    Ubiquitous image decoder still required by almost every web runtime that serves or processes PNGs; history of buffer overflows continues at lower volume than the parsers above.

    Source ↗
  7. 7
    SQLite

    Embedded in virtually every language runtime and many web frameworks; memory-safety issues are rarer than in the network parsers but still appear and carry high impact when they do.

  8. 8
    libjpeg / libjpeg-turbo

    JPEG decoding path present in almost every image-handling web stack; periodic critical overflows keep it on the watch list.

  9. 9
    Expat (libexpat)

    Lightweight XML parser still used by many C-based and language-extension stacks; smaller surface than libxml2 but not immune to memory corruption.

  10. 10
    PCRE / PCRE2

    Regular-expression engine embedded in PHP, Nginx, many language runtimes; complex matching logic has produced multiple high-severity memory issues over the years.

What Grok noticed

OpenSSL, zlib and libcurl remain among the three most widely deployed software components on the planet; their combined CVE history demonstrates that performance-critical C code continues to be the dominant residual risk even inside “memory-safe” language ecosystems.

Source ↗
🇺🇸 Gemini10 places · 1 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    OpenSSL (libcrypto / libssl)

    Safeguards TLS traffic across more than 80% of HTTPS servers, but a single missing bounds check in 2014 leaked the private memory of the entire web.

  2. 2
    zlib (libz)

    Silently linked into Node.js, Python, and PHP runtimes alike, leaving 47.1% of HTTP server responses dependent on a 30-year-old memory model.

  3. 3
    cURL (libcurl)

    Carries billions of automated backend API calls daily, yet a single SOCKS5 heap overflow in 2023 exposed modern microservices to remote hijack.

    Source ↗
  4. 4
    libxml2

    Parses untrusted documents behind Python lxml, Ruby Nokogiri, and PHP DOM, accumulating over 100 historical memory safety flaws along the way.

  5. 5
    PCRE / PCRE2

    Executes regular expressions in Nginx rewrite rules and PHP's preg engine, where nested recursion patterns routinely trigger out-of-bounds heap writes.

  6. 6
    GNU C Library (glibc)

    Forms the root system call layer of every standard Linux web container, where a dynamic linker overflow in ld.so granted unauthenticated local root.

  7. 7
    SQLite (libsqlite3)

    Embeds a full SQL engine inside PHP PDO, Python sqlite3, and Node.js runtimes, creating memory corruption pathways via crafted virtual tables.

  8. 8
    ICU (libicu)

    Manages Unicode collation across Node.js and PHP intl modules with parsing tables so intricate that integer overflows lead to arbitrary code execution.

  9. 9
    Brotli (libbrotli)

    Bundled natively into PHP and Node.js for rapid stream decoding, where an October 2026 out-of-bounds write forced urgent multi-version binary rebuilds.

    Source ↗
  10. 10
    ImageMagick (libMagickCore)

    Delegates untrusted user avatar and media uploads to legacy C decoders, triggering recurring memory corruption and remote command injection incidents.

    Source ↗

What Gemini noticed

High-level server languages provide memory safety in application code, but delegating byte parsing to foundational C/C++ libraries means that over 80% of remote code execution vulnerabilities occur below the language runtime boundary.

Source ↗
🇺🇸 Nova5 places · 2 notes

The same question, answered by Nova alone. The final list above combines all the AIs.

  1. 1
    Zstandard (Zstd)

    Decompresses at 200-400 MB/s while achieving 2.5-3.5x compression ratio, but its 2026 stream-validation flaw raised DoS risks.

    Source ↗
  2. 2
    Brotli

    Google's 4-5x ratio compressor used in PHP 8.2+, but CVE-2026-111497 turned decompression into an RCE vector.

  3. 3
    Gzip (DEFLATE)

    The web's original compressor, still handling 80% of HTTP traffic at 1.5-2x ratio but plagued by historic zlib flaws.

    Source ↗
  4. 4
    LZ4

    Fastest decompressor at 500+ MB/s but only 1.5-2x ratio; its simplicity avoids complex vulnerabilities seen in Brotli/Zstd.

    Source ↗
  5. 5
    Zlib (gzip/deflate)

    Core library for Gzip, with historic buffer-overread flaws (CVE-2022-37434) but still the safest bet for legacy systems.

What Nova noticed

LZ4's zero CVEs and 512 MB/s decompression make it the safest high-performance choice, but its 1.6x ratio limits bandwidth savings.

Source ↗

Zstd offers the best balance of speed (321 MB/s) and ratio (2.87x), but its 2026 DoS flaw proves even modern algorithms aren't immune to edge-case attacks.

Source ↗
🇨🇳 StepFun10 places · 1 notes

The same question, answered by StepFun alone. The final list above combines all the AIs.

  1. 1
    OpenSSL (libssl / libcrypto)

    330 CVEs on record and a single January 2026 advisory that shipped 12 at once - every HTTPS handshake on the web runs through it.

    Source ↗
  2. 2
    zlib (libz)

    19 CVEs, and an inflate() heap overflow that sat in the default HTTP gzip path all the way through 1.2.12.

  3. 3
    libcurl

    PHP, Python and Ruby all ship it, and the SOCKS5 heap overflow that earned a 9.8 from NVD.

    Source ↗
  4. 4
    libxml2

    116 CVEs, and one integer overflow that rippled out into PHP and Swift at the same time.

    Source ↗
  5. 5
    PCRE2

    PHP's preg_* and nginx's location blocks are regex in C - 19 CVEs in the PCRE2 product alone, 66 across the wider PCRE family.

    Source ↗
  6. 6
    SQLite3

    87 CVEs on the counter - and a maintainer page arguing that most of them do not apply to you.

  7. 7
    Brotli (Google's C decoder)

    The newest entry on this list, and the only one that got a remote-code-execution bug in a bundled decoder across Node.js, Bun, PHP and Python at the same moment.

  8. 8
    libexpat

    70 CVEs in the streaming XML parser that Python's standard library and a long tail of C++ services link against.

  9. 9
    libjpeg-turbo

    Every uploaded avatar on the web passes through a C JPEG decoder with 17 CVEs behind it.

  10. 10
    glibc (GNU C Library)

    The substrate under every PHP, Node.js, Python, Ruby and .NET process on Linux - 168 CVEs on one mirror, 13 on another, for the same query.

What StepFun noticed

curl is the clearest case of measurement disagreement: the project counts 146 security fixes across its history and its author states only two HIGH-severity CVEs have been published since 2021, while an independent analyzer (AISLE) surfaced six additional CVEs that frontier AI systems missed entirely.

Source ↗
🇨🇳 Kimi10 places · 1 notes

The same question, answered by Kimi alone. The final list above combines all the AIs.

  1. 1
    OpenSSL

    One C library under ~90% of the web's encrypted traffic, with an unbroken CVE advisory trail from 2002 to 2026.

  2. 2
    zlib

    Bundled into PHP, Node, Python and curl — and even linked inside OpenSSL itself; its worst inflate() bug scored 9.8.

  3. 3
    libcurl

    The HTTP client behind PHP's curl extension drags five other C libraries into every install — and keeps shipping its own CVEs.

    Source ↗
  4. 4
    libxml2

    PHP's XML parser absorbed five memory-corruption CVEs in a single 2025 update alone — use-after-frees, type confusion and a stack overflow.

  5. 5
    libexpat

    The SAX parser inside Python and countless tools fixed 14 vulnerabilities in a single June 2026 release.

  6. 6
    nghttp2

    HTTP/2's reference C implementation — linked by curl and PHP — owns the Rapid Reset and CONTINUATION-flood CVE classes.

    Source ↗
  7. 7
    PCRE2

    Every PHP preg_* call runs this C regex engine — whose JIT compiler turned crafted patterns into CVSS 9.1 out-of-bounds reads.

    Source ↗
  8. 8
    SQLite

    Inside PHP, Python and every browser — so clean that 2026's 'critical' CVEs filed against it were debunked as AI slop.

  9. 9
    Brotli (libbrotli)

    The youngest library here and already a live unauthenticated RCE — the exact 'ingress decompression' pattern, straight from the context story.

  10. 10
    GnuTLS

    The RHEL-family default TLS: a Project Zero-found double free in certificate verification is its signature bug class.

What Kimi noticed

CVE-counting itself is degrading as a measure: NVD moved to selective enrichment amid 44,509 disclosures in 2025 (up 263% in volume since 2020), and 2026 saw fabricated SQLite CVEs score 9.8-10.0 before being debunked.

Source ↗
🇨🇳 DeepSeek10 places

The same question, answered by DeepSeek alone. The final list above combines all the AIs.

  1. 1
    OpenSSL 2026

    296 CVEs, 40 rated 9.0+ and 27 in the 7.0–8.9 band — no other shared C library combines this deployment footprint with this density of remote memory-corruption history.

  2. 2
    zlib 2026

    19 CVEs since 2002, 9 with public exploits, and a CVSS 9.8 heap overflow in inflate — the decompressor behind gzip, PNG, and countless HTTP stacks.

  3. 3
    libxml2 2026

    133 CVEs tracked — an XML parser with more documented memory-corruption flaws than most operating-system kernels, silently loaded by PHP, Python, and Ruby runtimes.

  4. 4
    libcurl 2026

    The universal HTTP client: 18 CVEs fixed in a single June 2026 release, including a 25-year-old memory bug, and it is embedded in PHP, Node.js, and Python runtimes.

  5. 5
    glibc 2026

    162 CVEs in the GNU C Library — the deepest possible shared dependency, including a stack buffer overflow in ld.so reachable in setuid programs.

  6. 6
    libpng 2026

    Every PNG image passing through a web runtime touches libpng; 2026 alone brought a heap-based buffer overflow and a use-after-free in chunk handling.

    Source ↗
  7. 7
    libjpeg-turbo 2026

    17 CVEs in a library that decodes nearly every JPEG on the web; a 2026 heap-based buffer overflow in merged upsampling shows the image-decoding attack surface is still active.

    Source ↗
  8. 8
    PCRE2 2026

    The regex engine inside PHP and many web servers; 2026 produced an out-of-bounds write via integer overflow and a JIT memory-corruption flaw in pcre2_jit_match.

    Source ↗
  9. 9
    SQLite 2026

    The default database of PHP and mobile/web runtimes; a crafted FTS5 page can trigger an out-of-bounds read and heap buffer overflow in the full-text engine.

  10. 10
    nghttp2 2026

    The C HTTP/2 stack behind curl, Node.js, and many reverse proxies; malformed frame handling produced a remote denial-of-service and state-validation CVE in 2026.

    Source ↗
🇨🇳 Wenxin10 places

The same question, answered by Wenxin alone. The final list above combines all the AIs.

  1. 1
    zlib

    Deployed on 99% of all web servers and runtimes as the foundational DEFLATE implementation, with over 12 documented CVSS 8.0+ memory flaws in 20 years of public use

  2. 2
    PHP Core Runtime (C Implementation)

    Powers 70% of global websites on web servers, with three new unauthenticated RCE CVSS 9.0+ memory corruption flaws publicly disclosed in October 2026 alone

  3. 3
    OpenSSL

    TLS termination library used by 98% of all HTTPS web servers, with a long history of critical remote memory flaws including 2014's Heartbleed CWE-125 out-of-bounds read

  4. 4
    libc (GNU C Library)

    System C standard library that all Linux web runtimes depend on, hosting critical flaws like 2016's Ghost (CVE-2015-0235) that allowed unauthenticated remote code execution

  5. 5
    libbrotli

    Brotli decoder library now bundled with .NET, Node.js and Apache web servers, with a public RCE PoC (CVE-2026-111497) published on GitHub one day prior to October 27 2026

    Source ↗
  6. 6
    libcurl

    URL transfer library bundled with nearly every server-side runtime that makes outbound HTTP requests, holding 27 documented CVSS 8.0+ memory corruption flaws across its history

    Source ↗
  7. 7
    SQLite

    Embedded database library pre-bundled into PHP, Python, Node.js, and Ruby, with a consistent track record of remote parsing memory flaws when processing untrusted SQL input

  8. 8
    libxml2

    XML parsing library used by nearly all server-side web frameworks, responsible for dozens of historic remote XXE and buffer overflow flaws that process untrusted XML input

  9. 9
    zstd (libzstd)

    Fast new-generation compression library now included in 2026 Nginx, Node.js 22+ and modern web runtimes, with only 3 documented critical CVEs to date due to its younger codebase

    Source ↗
  10. 10
    libpng

    PNG image decoding library bundled with all backend languages that handle user-uploaded images, carrying 18 public documented critical buffer overflow vulnerabilities since its 1995 initial release

    Source ↗
🇨🇳 Qwen10 places · 1 notes

The same question, answered by Qwen alone. The final list above combines all the AIs.

  1. 1
    zlib

    The invisible lung of the internet, compressing 90% of web traffic while quietly dropping memory corruption CVEs every few years.

    Source ↗
  2. 2
    OpenSSL (libssl)

    The cryptographic bedrock that secures the web, yet its massive C codebase is a perpetual target for catastrophic heap corruptions like Heartbleed.

    Source ↗
  3. 3
    libcurl

    The universal data transfer engine for backend runtimes, recently caught handling HTTP/2 stream-dependency states with dangerous use-after-free logic.

    Source ↗
  4. 4
    libxml2

    The parser that processes untrusted SOAP and XML payloads, triggering the October 2026 PHP2Shell heap buffer overflow in stream wrappers.

    Source ↗
  5. 5
    libuv

    The asynchronous heartbeat of Node.js that manages thread pools and file I/O, occasionally stumbling over race conditions in C-level memory management.

    Source ↗
  6. 6
    libsqlite3

    The world's most deployed database engine, silently executing complex SQL state machines inside web frameworks without memory-safe boundaries.

    Source ↗
  7. 7
    libpng

    The image decoder that trusts pixel headers implicitly, historically allowing massive heap corruptions from a single malformed upload.

    Source ↗
  8. 8
    libjpeg

    Translating discrete cosine transforms into memory buffers, this library has weathered decades of integer wraparounds in untrusted image headers.

    Source ↗
  9. 9
    libicu

    Managing the immense complexity of Unicode collation in C, occasionally exposing deep buffer overflows when parsing malformed international strings.

    Source ↗
  10. 10
    PCRE (Perl Compatible Regular Expressions)

    Evaluating recursive regex patterns in C invites catastrophic backtracking and stack overflows when fed maliciously crafted search strings.

    Source ↗

What Qwen noticed

The October 2026 PHP emergency patches highlight that memory-safe languages like PHP still delegate untrusted network byte parsing to unmanaged native C libraries like Brotli and libxml2, creating systemic friction.

Source ↗