🔍 Read the full analysis: What Developers Should Check When Addressing Broccoli2Shell on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
CVE-2026-111497, known as Broccoli2Shell, is a memory-corruption flaw in Google’s Brotli decoder affecting versions 1.0.3 through 1.2.0 and software that includes them. Fixes are available across several runtimes and packages, but developers need to check how Brotli enters their stack and restart processes after patching. CISA reports no known exploitation in the wild; the scope of unfixed bundled copies is still developing.
Developers are being urged to check and patch CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder that can affect applications and runtimes using vulnerable versions. Fixes are available for several major platforms, but exposure depends on how each product uses or bundles Brotli, and services must be restarted to load updated code.
The flaw affects Brotli versions 1.0.3 through 1.2.0. The CVE record describes an out-of-bounds write and an unchecked return value. According to the Node.js advisory, malformed compressed input could be treated as incomplete rather than invalid, allowing the decoder to write beyond an internal buffer. Possible consequences include a crash or memory corruption; code execution is a potential worst-case impact, not a confirmed outcome for every affected system.
Available fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and releases of Envoy, Istio and .NET listed in the source material. Debian has published fixes for bookworm and trixie. Developers should verify exact package and platform advisories rather than assuming that upgrading an application framework updates its Brotli dependency.
Node.js says its official builds bundle Brotli, making the Node.js version the relevant fix path for those builds. Some Linux distributions instead link Node.js to a system Brotli library. Python applications may receive Brotli decoding through HTTP clients and related packages, while services that accept compressed request bodies or process compressed files also need review. A patched package does not replace the decoder already loaded by a running process: restart affected services after updating.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Where Brotli Enters Your Stack
The issue matters because Brotli is a shared compression component, not a vulnerability limited to one product. A vulnerable decoder can reach production through a runtime, a direct package dependency, an operating-system library or a copy bundled inside another tool. The source material’s independent tracker lists more than 30 projects and packages that include their own copy, though that count is not an official inventory and can change as maintainers publish updates.
Developers should check both incoming compressed data and software that reads compressed files. For example, Node.js fetch decodes Brotli responses automatically. Python HTTP libraries can do so when Brotli support is installed. The source reports that Express and body-parser versions in specified ranges inflate Brotli request bodies, but emphasizes the flaw is in Brotli, not Express; updating Express alone is not a substitute for updating the decoder. A bare Node.js HTTP server does not automatically decode request bodies.
Prioritize internet-facing services and features that process data from outside the organization, then include internal jobs and file-processing tools in the review. The CVE record assigns a CVSS 4.0 score of 9.2, rated Critical. That indicates high assessed severity, but it does not establish that a particular deployment is exploitable or has been attacked.
Products Worth Considering
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Source Fix to Runtime Patches
The source material dates the underlying Brotli change to February 27, 2026, when a commit titled “Detect and report invalid stream earlier” was made. It says the commit did not identify the change as security-related. Releases containing the fix began appearing on October 21, a gap of 236 days. That history helps explain why the vulnerable code had time to appear in downstream software; it does not by itself show that every project had notice of a security issue during that period.
The CVE became public on October 22, according to the supplied account, and a public proof of concept appeared the same day. Node.js shipped security releases on October 21, while Python package fixes and distribution advisories followed. The source says some dependency scanners did not list the Python packages on October 23, before an advisory was added later that day. This illustrates why developers should check upstream security notices as well as scanner results.
There are important version differences. The source lists fixes for Node.js 22, 24 and 26, and says Node.js 20, 23 and 25 have no fix. Teams on those branches should consult official project guidance for a supported upgrade or mitigation path; they should not assume a patch exists. The stated fixed versions are a snapshot dated October 26, 2026, so maintainers’ advisories should be checked for later changes.
“A bigger deal than PHP2Shell”
— Juliano Rizzo, as quoted by the supplied article
Unfixed Copies and Exposure Status
As of October 26, the supplied tracker lists seven bundled copies as still unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. It also says five additional projects had fixes in their main branches. These tracker findings are not a complete official accounting, and a fix in a development branch may not yet be present in a released version. Confirm each project’s status with its maintainers.
Known exploitation remains unconfirmed. The source says Imperva demonstrated code execution on an unmodified official Node.js image after several attempts. That is a reported demonstration under specific conditions, not evidence that attackers are using the flaw in the wild. The supplied account says CISA data lists exploitation as “none” and that the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. Those records describe the reported status at the time of writing; they cannot establish that no unreported activity exists.
For an individual system, the affected route and practical impact depend on the exact decoder, build configuration, input path and runtime version. The source does not provide a complete list of vulnerable configurations or a universal test for exposure. Developers should avoid treating the CVSS score or a demonstration as proof that every deployment is remotely exploitable.
Patch, Restart, Verify Coverage
Start with an inventory of runtime and package versions, including operating-system libraries and bundled dependencies that standard package manifests may not show. Check release notes for the exact product and build, then apply a fixed version or follow the maintainer’s supported guidance where a fix is unavailable. Give priority to services that decode untrusted responses or request bodies, while also reviewing tools that unpack or inspect compressed files.
After patching, restart affected processes and verify that deployed containers, hosts and serverless images actually use the fixed decoder. Retest dependency and vulnerability scans after advisory data has updated, but do not rely on a clean scan alone: bundled copies and delayed advisory listings may be missed. Teams should continue to monitor vendor and distribution notices as downstream fixes are released.
The next meaningful milestone is the release or confirmation of fixes for the remaining bundled copies, alongside updated guidance for unsupported Node.js branches. The source gives no confirmed timeline for those projects, so affected teams should check maintainers’ current advisories rather than wait for a general all-clear.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli decoder. The reported bug can cause memory corruption when the decoder processes certain malformed compressed input.
Which Brotli versions are affected, and which are fixed?
The supplied material identifies Brotli 1.0.3 through 1.2.0 as affected. It lists fixed library releases as 1.0.10, 1.1.1 and 1.2.1. Check the advisory for your specific package because downstream products may bundle or modify the decoder.
Is upgrading Express enough to address the flaw?
No. The reported vulnerability is in Brotli, not Express. If a service uses a vulnerable Brotli decoder to inflate request bodies, updating Express alone may leave that decoder unchanged. Verify and patch the actual dependency or bundled library.
Does a successful patch require a restart?
Yes, according to the supplied material: a running process can keep using the old decoder after its files or packages are updated. Restart affected processes, then confirm the deployed runtime or image contains the fixed version.
Has the flaw been exploited in the wild?
The supplied source says CISA’s data reports no exploitation and the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog. Imperva reportedly demonstrated code execution on an unmodified Node.js image, but that is not confirmation of attacks in the wild. The status may change as reporting develops.
Source: ThorstenMeyerAI.com
