🔍 Read the full analysis: Broccoli2Shell Security Review: Find Affected Compression Components on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli C decoder affects versions 1.0.3 through 1.2.0 and has prompted fixes across Node.js, Python packages, Bun, Envoy, Istio, .NET and Linux distributions. Researchers demonstrated code execution on an unmodified Node.js build, but CISA data cited in the report lists no exploitation in the wild. Teams need to identify affected copies, install the relevant fixed versions and restart running processes.
Security fixes for Broccoli2Shell, CVE-2026-111497, are now available for several major runtimes and packages after researchers reported a memory-corruption flaw in Google’s Brotli decoder. The flaw affects decoder versions 1.0.3 through 1.2.0; an independent demonstration reportedly ran code on an unmodified Node.js build, though the available source material says there is no known exploitation in the wild.
The vulnerability is in Brotli’s C decoder, not in every framework or application that uses it. The Node.js advisory describes malformed compressed input that the decoder handled as though it were incomplete rather than invalid. According to the advisory, that behavior could cause writes beyond an eight-byte internal buffer. The resulting memory corruption can crash a process or potentially expose memory or enable code execution, depending on the circumstances. Google’s CVE record classifies the issue as an out-of-bounds write and an unchecked return value.
Patched releases listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. The applicable release depends on the software and distribution. The source says Node.js 20, 23 and 25 have no fix.
Updating a package does not necessarily update every copy of the decoder in a deployment. Some software bundles Brotli, while other builds use an operating system’s library. The report says official Node.js builds include their own copy, so those installations need a fixed Node.js release. After applying an update, operators must also restart running processes; a process that remains open continues using its loaded decoder.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Patches Must Reach Every Copy
The flaw matters because Brotli is widely used to reduce the size of web data, and the decoder can enter systems through several software layers. Node.js can decode compressed responses through its built-in fetch function. Python clients may use Brotli when a compatible package is installed, and some web frameworks or body parsers can decompress incoming request bodies. The issue can also affect file-handling tools that use the C library.
That spread complicates remediation: a team may patch its application but leave a bundled or system-level copy untouched. The source identifies more than 30 projects and packages in an independent tracker, with seven bundled copies still unfixed as of October 26. That count is the tracker’s reported status, not a measure of confirmed attacks. Operators need to check the actual dependency and build used by each service, container and tool rather than assume one top-level upgrade covers them all.
Risk also depends on exposure. Systems that process attacker-supplied compressed responses, request bodies or files may have a path to the vulnerable decoder; the source does not establish that every installation is remotely reachable. The practical priority is to locate affected components, apply their vendor’s fixed release, and restart services. Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0, while the source reports no exploitation listed by CISA.
Products Worth Considering
Apple iPad Air (4th Generation, 10.9-inch, Wi-Fi, 256GB) – Space Gray
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Logitech MX Mechanical Mini Mac Wireless Keyboard Low-Profile – Space Grey
As an affiliate, we earn on qualifying purchases.
A Delayed Fix Reaches Downstream
The source traces the underlying code change to February 27, 2026, when Brotli’s source repository received a fix titled “Detect and report invalid stream earlier.” It says the change was not identified as a security fix at the time and was not included in a release until October 21. The report describes that interval as 236 days. This is the time between the source change and releases carrying it, not evidence that attackers knew about or exploited the flaw throughout that period.
The vulnerability became public on October 22, according to the report, and a public proof of concept appeared on GitHub the same day. Fixes then had to move through projects that bundle or depend on Brotli. The report says Python packages were missing from advisory databases on October 23 before GitHub added an advisory later that day, illustrating how dependency scanners can miss a flaw when package records lag.
The issue has also drawn attention to AI-assisted security work. The source says Node.js credits OpenAI Codex Security, and OpenAI said the flaw was found during red-teaming with teams of AI agents. Those statements describe the discovery process; they do not change the technical scope of the vulnerability or establish that all affected projects have been patched.
“The decoder treated one kind of malformed input as ‘waiting for more data’ instead of ‘this is broken.’”
— Node.js security advisory, as summarized by ThorstenMeyerAI.com
Exposure and Remaining Bundles
The source reports that CISA’s data lists “exploitation: none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the report date. Those indicators do not prove that exploitation has never occurred; they describe the status cited in the source. Imperva reportedly ran code on an official Node.js image after several attempts, but the material does not provide enough detail to assess the conditions or reproduce the demonstration.
The exact number of vulnerable deployments is unknown. The tracker reportedly listed seven bundled copies as still unfixed on October 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; five additional projects had fixes in their main branches. A fix in a development branch is not necessarily present in a released product. The status of individual installations, downstream packages and later releases may change after publication.
The source does not establish that every use of Brotli exposes an application to remote attack. Whether an attacker can supply data to a vulnerable decoder depends on how a product handles responses, request bodies or files. It also does not provide a complete inventory of affected versions for every downstream project.
Verify Updates and Restart Services
Administrators should check vendor advisories and dependency inventories for the exact runtime, package, distribution and bundled libraries in use. Apply the corresponding fixed release, then restart affected services and workloads so they load the updated decoder. Where a project has not yet published a release, teams should follow its official security notices and assess whether the vulnerable component processes untrusted compressed data.
Security teams should also check container images and build artifacts, not just source manifests: a software package may contain its own Brotli copy, and a system-linked build may rely on a separate distribution update. The tracker status and package availability can change; the source’s list should be treated as a snapshot from October 26, 2026, rather than a current guarantee about every project.
The next concrete milestone is the release of fixes by remaining downstream maintainers and confirmation that those fixes have reached shipped versions. Until then, the source supports a measured response: patch where updates exist, restart processes, and verify exposure without treating an unconfirmed attack scenario as evidence of active exploitation.
Key Questions
What is Broccoli2Shell?
It is the name used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. The issue can cause memory corruption when the decoder processes certain malformed compressed input.
Which software is affected?
The source lists Brotli decoder versions 1.0.3 through 1.2.0 and affected downstream software including Node.js, Python Brotli packages, Bun, Envoy, Istio, .NET and some Linux distributions. The affected version and fix depend on the specific product and build.
Is Broccoli2Shell being exploited in the wild?
The source reports that CISA data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. That is the reported status, not proof that exploitation has never occurred.
What should administrators do?
Identify every Brotli copy in affected runtimes, packages, system libraries and bundled software; install the vendor’s fixed release; and restart running processes. A package update alone may not replace a decoder already loaded by a running service.
Does upgrading Express fix the issue?
Not by itself, according to the source. The flaw is in Brotli, not Express. If a deployment uses an affected Brotli decoder to inflate request bodies, administrators need to update the underlying component and check the relevant vendor guidance.
Source: ThorstenMeyerAI.com
