🔍 Read the full analysis: Where Broccoli2Shell Reaches: Compression Bug Fixes For Node.js And Python on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, can cause memory corruption when software processes crafted compressed data. Fixes have reached Node.js, Python packages and several other projects, but seven bundled copies were still listed as unpatched on October 26. There is no reported in-the-wild exploitation in the cited sources.
Fixes for a critical flaw in Google’s Brotli decoder are now available for Node.js, Python packages and several other projects, addressing a bug that can corrupt memory when software processes a crafted compressed stream. The flaw, CVE-2026-111497, affects Brotli C library versions 1.0.3 through 1.2.0; the cited sources report no known exploitation in the wild, but say affected running processes need to be restarted after patching.
The decoder could treat malformed compressed input as if it were incomplete and needed more data. According to the Node.js advisory, that behavior could cause writes beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on how the affected software is exposed and used, memory corruption can cause a crash, disclose memory contents or potentially enable code execution. Those are potential outcomes, not a claim that every affected deployment is exploitable in the same way.
Available fixes include Google Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The source material also lists releases for Bun, Envoy, Istio, .NET and Debian. It says Node.js versions 20, 23 and 25 will not receive fixes, so users of those branches need to check their support and migration options rather than assume a patch is forthcoming.
Updating a package or runtime does not change code already loaded into a process: the source material says affected services must restart to use the fixed decoder. Teams also need to check how Brotli enters their software. Official Node.js builds bundle Brotli, while some Linux builds use a system library; Python clients and server frameworks may rely on separately installed Brotli packages.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Stacks
Brotli is a common compression format, so the issue reaches beyond a single runtime or application. Software can encounter the decoder when it automatically unpacks compressed web responses, accepts compressed request bodies, or reads files handled by tools that use Brotli. The source material names Node.js fetch and Python HTTP clients as examples, as well as webhooks, link previews, crawlers and URL-import features. Exposure depends on whether the affected decoder is present and whether a program processes attacker-controlled compressed data.
The fixes have to pass through a chain of maintainers and deployments: from the Brotli library into a runtime or package, then into distributions and container images, and finally into restarted services. An independent tracker cited in the source material listed more than 30 projects and packages that bundle their own copy. As of October 26, it still listed seven bundled copies as unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. That means updating a direct dependency alone may not cover every copy in a software environment.
For operators, the practical concern is both risk and coverage: identify which decoder a service actually uses, apply the matching release and restart it. The source material says Imperva demonstrated code execution on an official Node.js image after several attempts. That is a reported demonstration, not evidence that attacks are occurring broadly or that every affected installation can be exploited remotely.
As an affiliate, we earn on qualifying purchases.
A February Fix Reached Releases in October
The underlying change appeared in the Brotli source code on February 27, 2026, according to the article’s review of the GitHub commit. The commit was titled “Detect and report invalid stream earlier” and did not identify the change as a security fix. Releases containing it appeared on October 21, the source says—a gap of 236 days. OpenAI said on X that the security significance was not known at the time and that no newer Brotli release was available.
The vulnerability became public on October 22, and the source material says a proof of concept appeared on GitHub the same day. The issue first drew attention in Node.js security releases, then broadened as patches appeared for Python packages and other projects. The article credits OpenAI Codex Security in the Node.js acknowledgments; OpenAI said the flaw was found during red-teaming with teams of AI agents. Those are attributions from the source, not independent evidence here about how much the tools contributed to discovery.
The name “Broccoli2Shell” is used by the cited tracking site and reflects the broader discussion of the flaw. A separate DreamHost password-reset incident mentioned in the source material has no stated cause and is not linked to Brotli. It is unrelated to this vulnerability report.
““A bigger deal than PHP2Shell” and “zlib 20 years ago.””
— Security researcher Juliano Rizzo, as quoted by the cited tracker
network security appliance firewall for small business
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Exposure Depends on Each Deployment
The available information does not establish how many systems are vulnerable or whether attackers have exploited the flaw outside demonstrations. The source says Google’s CVE record assigns a CVSS 4.0 score of 9.2, rated Critical, while CISA’s data lists exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the report. Those records indicate no listed known exploitation in the cited sources; they do not prove that exploitation is impossible or that every database is complete.
It is also not clear from the source whether all software vendors have published fixes or advisories for their bundled copies. The tracker listed seven copies as unfixed and five more as fixed in their main branches, but a main-branch change is not necessarily a packaged release. The exact exposure of any service depends on its runtime or system library, its dependency versions, its configuration and whether it accepts or fetches compressed data from an untrusted source.
As an affiliate, we earn on qualifying purchases.
Patch Releases and Restarts Remain
Operators should identify affected runtimes, Python packages, system libraries and bundled copies, then apply the release specified by the relevant vendor or project. Teams should verify the version actually present in deployed images and hosts, not only their package manifest, and restart services after updating so the fixed decoder is loaded. Where a project has not released a package, its maintainers’ advisories and release notes will determine when a deployable fix is available.
The tracker and vendor notices may change as projects publish updates. The source material reports that Python packages were missing from an advisory database on October 23 before GitHub’s advisory was added later that day, illustrating why teams may need to check both dependency-scanning results and upstream security announcements. No later deadline or coordinated update schedule is given in the source.
encrypted external SSD for secure backups
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is CVE-2026-111497?
It is a vulnerability in Google’s Brotli C decoder, affecting versions 1.0.3 through 1.2.0. Malformed compressed input can trigger an out-of-bounds write and memory corruption.
Which Node.js versions have a listed fix?
The source lists fixes in Node.js 22.23.4, 24.22.1 and 26.12.1. It says versions 20, 23 and 25 will not receive a fix.
Are Python Brotli packages affected?
Yes. The listed fixed releases are Brotli 1.2.1 and brotlicffi 1.2.1.0. Python applications may use these packages through HTTP clients or other libraries, depending on installed dependencies.
Is the flaw being exploited in the wild?
The cited material reports no known exploitation in the wild. It describes a code-execution demonstration by Imperva on an official Node.js image after several attempts; that demonstration is not the same as evidence of active attacks.
Why does restarting matter after a patch?
A running process may keep using the old decoder loaded before the update. The source advises restarting affected processes so they load the patched library or runtime.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
