🔍 Read the full analysis: What To Patch And Verify When Broccoli2Shell Reaches Your Technology Stack on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Broccoli2Shell vulnerability, CVE-2026-111497, affects Google’s Brotli decoder in versions 1.0.3 through 1.2.0 and reaches multiple runtimes and applications that bundle it. Fixed releases are available for several widely used components, but teams must identify bundled copies, update packages or runtimes, and restart processes. As of October 26, the source reports no known in-the-wild exploitation, while some bundled projects remain unfixed.
Broccoli2Shell, a vulnerability in Google’s Brotli decoder tracked as CVE-2026-111497, can corrupt memory when software processes a crafted compressed stream. Fixes are available for several runtimes and libraries, but the decoder is bundled across many technology stacks, so organizations need to check indirect dependencies and restart affected services after patching.
The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0. The Node.js advisory describes malformed input that the decoder treated as incomplete rather than invalid, allowing it to write beyond an internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Memory corruption can cause a process to crash or expose data; code execution is a potential worst-case outcome, not an outcome established for every affected application.
Fixes listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. The listed Envoy fixes are 1.40.0, 1.39.3, 1.38.6 and 1.37.8; Istio fixes are 1.29.9, 1.30.6 and 1.31.2. The source also lists fixed .NET runtime releases and Debian package updates. Node.js 20, 23 and 25 are identified as receiving no fix.
For operators, patching a dependency is only part of the work: running processes retain the old decoder until restarted. The source says official Node.js builds bundle Brotli, meaning the Node.js version is the relevant update for those builds. Other systems may link against an operating-system library or carry their own copy, so teams should verify the build and package actually deployed rather than rely on a direct-dependency scan alone.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Bundled Decoders Need Checks
The issue matters because Brotli is used across web and software infrastructure, and a single decoder flaw can reach applications through layers that teams may not recognize as dependencies. Node.js can automatically decompress Brotli responses through its built-in fetch function. Python HTTP clients may do the same when a Brotli package is installed. The source also identifies services that inflate compressed request bodies, as well as tools that handle files such as archives, fonts, Parquet data and firmware.
That spread changes the response from a routine library upgrade into an inventory and verification task. A service may be exposed while fetching a remote response, accepting a compressed body, or processing a file; whether any particular deployment is reachable depends on its configuration and data paths. The source says the vulnerability is rated Critical, with a CVSS 4.0 score of 9.2. Imperva reported achieving code execution on an unmodified official Node.js image after several attempts. That demonstration indicates potential severity, but does not establish exploitation in deployed systems.
Teams should identify affected runtimes, packages, containers and tools; apply the appropriate vendor or distribution update; rebuild images where needed; and restart running services. They should also verify the effective decoder version, since updating an application framework alone may not replace a separate Brotli library. The reported 236-day period between the source-code change and releases carrying the fix also illustrates how a correction in a shared component may take time to reach downstream users.
Products Worth Considering
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Source Fix to Runtime Releases
The source says the underlying code change was committed to Brotli on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says that change did not mention security. OpenAI later said the security significance was not known at the time and that no newer Brotli release was available. Releases containing the fix appeared on October 21, according to the account; the CVE became public on October 22.
Node.js credits OpenAI Codex Security, and OpenAI said the flaw was found during red-teaming with teams of AI agents. The source reports a public proof of concept appearing on GitHub on October 22. It also says that by October 26 an independent tracker listed more than 30 projects and packages with bundled copies, including seven that it still listed as unfixed. Examples named there include DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. These project-level statuses can change, so operators should check current advisories before deciding a component remains vulnerable.
The concern is not limited to Node.js. The source describes fixes landing across Python packages and Linux distributions and notes that some distributions build Node.js against a system Brotli library. It reports about 83 million downloads of the Python Brotli package in the previous month, based on pypistats.org and checked October 26. That is a download count, not a measure of vulnerable installations or active exposure.
Exposure and Remaining Unfixed Copies
The source reports that known exploitation in the wild had not been identified as of October 26. It says CISA’s data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog. Those details describe the status reported at that time; they do not prove that no undiscovered attacks have occurred.
It is not clear from the source how many organizations use affected builds or how many are exposed through a reachable input path. A vulnerable version alone does not establish that an application can be attacked: exposure depends on whether it processes attacker-controlled compressed data and how the decoder is used. The source also lists bundled copies without fixes as of October 26, while noting that additional projects had fixes in their main branches. A fix in a development branch may not yet be included in a released package.
The source does not provide a complete, continuously updated inventory of affected products or current vendor response times. The separate DreamHost password-reset incident mentioned in the material has no stated cause and is not linked to Broccoli2Shell; the two developments should not be treated as connected.
Patch, Restart and Recheck
Technology teams should compare deployed versions against current advisories from runtime, package, distribution and product maintainers. Include containers, operating-system packages, language libraries and tools that bundle Brotli internally. Where software links to a system library, verify the library version supplied by the distribution; where it bundles Brotli, check for a product-specific update.
After installing a fix, rebuild affected images and restart processes that may have loaded the old decoder. Then confirm the running version and review relevant service and application logs for failures or unusual behavior. For components without a released fix, track the maintainer’s advisory and release status, and consider whether the component can be isolated or temporarily removed from paths that process untrusted compressed data. The source provides no single date by which all listed projects will ship fixes, so remediation remains a continuing inventory and verification task.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli decoder. According to the source, malformed compressed input can trigger an out-of-bounds write and corrupt memory.
Which versions should teams check?
The source identifies Brotli C versions 1.0.3 through 1.2.0 as affected and lists fixes across Node.js, Python packages, Bun, Envoy, Istio, .NET and Debian. Check the relevant vendor advisory for the exact fixed version used by your deployment.
Does upgrading Express fix the issue?
Not by itself, according to the source. It says affected Express and body-parser releases can inflate Brotli request bodies, but the flaw is in the Brotli decoder rather than Express. Verify and update the decoder or runtime actually used.
Is the vulnerability being exploited?
The source reports no known in-the-wild exploitation as of October 26, 2026. It also describes an Imperva code-execution demonstration on an official Node.js image after several attempts; a demonstration does not establish active attacks in the wild.
Why must services be restarted after patching?
A running process can continue using the decoder it loaded before the update. The source says restarting affected processes is necessary for the patched decoder to take effect.
Source: ThorstenMeyerAI.com
