🔍 Read the full analysis: Broccoli2Shell: Check Your Dependencies, Then Patch And Restart on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
CVE-2026-111497 affects Google’s Brotli C decoder and can cause memory corruption when it processes crafted compressed data. Fixes are available for several runtimes and packages, but some bundled copies remain unfixed; services must be restarted after patching to load the repaired decoder.
Security fixes for CVE-2026-111497, a flaw in Google’s Brotli decoder that can corrupt memory when handling crafted compressed data, are now available for several widely used runtimes and packages. Developers and operators need to check both direct and bundled dependencies, install the applicable update and restart running processes; the issue affects more than Node.js, while some projects still have no released fix.
The vulnerability, called Broccoli2Shell, affects Brotli C decoder versions 1.0.3 through 1.2.0, according to the supplied security reporting and project advisories. The decoder can mistake malformed input for data that is merely incomplete, then write beyond an internal eight-byte buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Possible outcomes include a process crash or memory corruption; code execution is a demonstrated possibility, not an established outcome for every affected application.
Updates listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and patched releases of Envoy, Istio and .NET. The source says Node.js 20, 23 and 25 will not receive fixes. Operators should consult the relevant vendor advisory for their exact platform and support status rather than assume that a patch for another version applies.
Updating a package does not repair a decoder already loaded by a live process. The source’s instruction is to patch and restart, then confirm the running service uses the fixed version. The exposure depends on how an application uses Brotli: examples include automatically decoding fetched responses, accepting compressed request bodies through a parser, or processing files with a vulnerable bundled decoder. A bare Node.js HTTP server does not, by itself, decode request bodies.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Bundled Brotli Needs Checking
The flaw matters because Brotli is a small, widely reused component rather than a vulnerability confined to one application. A project can inherit it through a runtime, a Python package, a proxy, a distribution build or a separately bundled copy. That makes ordinary inventory checks less reliable: updating a top-level framework alone may leave the vulnerable decoder in place.
For example, the source says Express is not itself the source of the bug. Express versions that inflate Brotli request bodies can expose applications when paired with a vulnerable decoder, but upgrading Express alone does not fix Brotli. Likewise, official Node.js builds bundle Brotli, while some Linux distribution builds use the system library. The right repair depends on how the software was built and deployed.
The practical risk also changes after deployment. A fixed package on disk does not necessarily mean a production worker, container or long-running service has loaded it. Restarting is part of the remediation, and operators may need to rebuild and redeploy images as well as update dependencies. The source reports that Imperva demonstrated code execution on an unmodified official Node.js image after several attempts, while stressing that this is a demonstration—not evidence that all affected installations are exploitable in the same way.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Dependent Projects
The source traces the underlying code change to February 27, 2026, when a Brotli source commit titled “Detect and report invalid stream earlier” was made. The fix was not described as a security change at that time. Security releases carrying it appeared on October 21, and the CVE became public on October 22, according to the supplied account. That is a 236-day interval between the source fix and the releases identified in the report.
The gap matters because downstream projects often bundle or package dependencies on their own schedules. After disclosure, maintainers had to carry the repair into runtimes, language packages, operating-system packages and application images. The supplied tracker lists more than 30 projects or packages with bundled copies; as of October 26, it says seven remained without a released fix, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. Those tracker figures are a snapshot and may change.
The source reports that Google’s CVE record assigns the issue a 9.2 Critical score under CVSS 4.0. It also says CISA data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time of writing. These details describe the reported status on October 26; they do not establish that exploitation is impossible or that the status will remain unchanged.
““A bigger deal than PHP2Shell””
— Juliano Rizzo, security researcher, as quoted by broccoli2shell.com
Exposure and Unpatched Copies
The full set of vulnerable deployments is not established by the supplied material. A project’s exposure depends on its Brotli version, whether it bundles its own decoder or uses a system library, and whether untrusted compressed data reaches that decoder. The source’s tracker is a dated snapshot; its list of seven projects without released fixes may have changed since October 26.
The supplied account reports no exploitation in CISA’s data and no entry in the Known Exploited Vulnerabilities catalog at that time. It also describes an Imperva code-execution demonstration on an official Node.js image after several attempts. Those facts are not contradictory: a research demonstration does not establish active attacks, while a lack of recorded exploitation does not rule out undiscovered activity. The source does not provide evidence about attacks against production systems.
It is also unclear from the material which downstream vendors have completed releases beyond the named versions, or how quickly every dependent application will deploy them. The separate DreamHost password-reset incident mentioned in the source has no stated cause and is not linked to Brotli; it should not be treated as evidence of Broccoli2Shell exploitation.
Verify Releases, Then Restart Services
Operators should inventory direct and transitive dependencies, check runtime and operating-system advisories, and look for software that vendors bundle independently. Apply the fix recommended for the deployed build, including patched container images where relevant. Then restart or redeploy affected processes and verify that they are running the repaired decoder, rather than relying only on a package file or lockfile change.
Teams using projects still listed as unfixed should monitor the upstream project’s security notices and distribution trackers, and assess whether those components process untrusted Brotli-compressed input. The next developments are likely to be additional downstream releases and changes to the affected-project lists. The supplied source does not give a common deadline for those releases, so organizations will need to follow their own vendors and maintainers.
Key Questions
What is Broccoli2Shell?
It is the name used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. Crafted malformed compressed input can trigger an out-of-bounds write and memory corruption.
Does updating my application framework fix the vulnerability?
Not necessarily. The vulnerable decoder may come from a runtime, package, operating-system library or bundled copy. The source specifically says updating Express alone does not repair Brotli; check which decoder your deployed build uses.
Why must services restart after the patch?
A running process may keep the old decoder loaded in memory after files or packages are updated. Restarting or redeploying allows the service to load the patched version.
Has the flaw been exploited in the wild?
The source says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also reports a research demonstration of code execution. The supplied material does not establish active attacks against production systems.
Which versions are listed as fixed?
The source names Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4, along with updates for Envoy, Istio, .NET and Debian. Confirm the right release with the vendor or project’s current advisory.
Source: ThorstenMeyerAI.com
