🔍 Read the full analysis: What Should You Patch, Restart, And Check After Broccoli2Shell? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Broccoli2Shell, CVE-2026-111497, is a memory-corruption flaw in Google’s Brotli C decoder that affects versions 1.0.3 through 1.2.0 and has reached multiple runtimes and products. Fixed releases are available for several platforms, but running processes need restarting to load them; the source reports no confirmed exploitation in the wild as of October 26, 2026.
Broccoli2Shell, a vulnerability in Google’s Brotli compression decoder tracked as CVE-2026-111497, has prompted fixes across Node.js, Python packages and other software that uses or bundles Brotli. Administrators should update affected components and restart running services, because processes can continue using the old decoder until restarted; the supplied source reports no confirmed exploitation in the wild as of October 26, 2026.
The flaw affects Google’s Brotli C decoder versions 1.0.3 through 1.2.0. The Node.js advisory describes malformed compressed input that the decoder treated as incomplete rather than invalid, allowing it to write beyond an internal eight-byte buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on circumstances, memory corruption can cause a crash, expose memory or potentially enable code execution.
Reported fixed versions include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and specified Envoy, Istio and .NET releases. The source says Node.js 20, 23 and 25 have no fix. Debian fixes are listed for bookworm and trixie. Teams should check the advisory for their exact operating system and product version rather than assume a library-level upgrade reaches every installed copy.
Exposure depends on how software processes compressed data. Examples include applications that fetch Brotli-compressed responses, services that inflate compressed request bodies, and tools that read Brotli-using files or archives. A bare Node.js HTTP server does not decode request bodies by itself, according to the source; frameworks or middleware may do so. Official Node.js builds bundle Brotli, while some Linux builds use the system library, making the relevant patch path dependent on the build.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Patch Paths Across Brotli-Using Software
The risk is not limited to a single application: one shared decoder appears in multiple runtimes and products, and some projects ship their own copies. A team can update its direct dependency yet remain exposed if a container image, operating-system package or separately bundled component still carries a vulnerable version. The source cites an independent tracker listing more than 30 projects and packages that bundle their own copy, with seven still unfixed as of October 26.
The fix also needs to reach live processes. Updating a package on disk does not retroactively replace code already loaded into a running service. After applying the appropriate update, operators should restart affected processes and verify the version actually in use. This makes inventory and deployment checks as important as the package-manager command.
Severity is high, but the available evidence should be described carefully. Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0. Imperva reported running code on an official Node.js image after several attempts, a demonstration of potential impact rather than evidence that attackers are exploiting the flaw. The source says CISA’s data lists exploitation as none and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time of publication.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
Anker SOLIX C200 DC Portable Power Station, 192Wh, 200W
As an affiliate, we earn on qualifying purchases.
From Brotli Fix to Public Alert
The source reports that a Brotli source-code change addressing the behavior was committed on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says releases carrying the fix appeared on October 21, a gap of 236 days. OpenAI said the security significance was not known when the change was made and that Brotli had not had a more recent release. The source reports that the CVE became public on October 22, alongside a public proof of concept.
Node.js shipped a security release on October 21, with the Brotli issue among several fixes, and subsequent patches have appeared in other projects and distributions. The source says Python packages were absent from some advisory databases on October 23, then were added to GitHub’s advisory database later that day. That history illustrates why organizations should check vendor and distribution advisories as well as broad dependency-scanning alerts.
The source also reports that Node.js credited OpenAI Codex Security, and OpenAI said it found the issue during red-teaming with teams of AI agents. Those are attributed statements about discovery; they do not change which versions are affected or replace the need to verify patches in each environment.
Unfixed Copies and Exploitation Status
The full set of affected installations remains difficult to establish because products may bundle their own Brotli copies, and some operating-system builds link against system libraries instead. The source’s tracker listed seven bundled copies still unfixed on October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. It says five additional projects had fixes in their main branches, which does not necessarily mean a released, deployed fix was already available.
The supplied material reports no known exploitation in the wild and says the CVE was absent from CISA’s KEV catalog at that time. That is a status report, not proof that exploitation is impossible or that every environment is unaffected. The material does not establish whether any specific organization has been attacked, how many deployments remain vulnerable, or when each unfixed project will ship a release. A separate DreamHost password-reset incident mentioned in the source has no stated cause and is not linked to Brotli.
Verify Fixes in Live Deployments
Administrators should first inventory runtimes, packages, system libraries, container images and products that parse Brotli data. Compare each installed component with its vendor’s advisory and the fixed versions listed for that exact release line. Pay particular attention to Python Brotli and brotlicffi dependencies, Node.js versions, proxies and service meshes, and applications that decompress incoming bodies or fetched responses. Where a product bundles Brotli, updating the system package alone may not update that copy.
After patching, redeploy or restart every affected service and worker, then verify the running version from the actual process or rebuilt image. Review deployment records and relevant crash or application logs for unusual failures, but do not treat a lack of alerts as proof that a component was patched. If no fixed release is available for a bundled dependency, follow the maintainer’s advisory, assess whether the component accepts untrusted compressed input, and consider limiting that exposure while awaiting a release.
Further updates are expected as projects and distributions publish releases and advisories. The immediate check is whether the decoder in each live workload is fixed—not merely whether a package file or source repository has changed.
Key Questions
What is Broccoli2Shell?
It is the name used for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The source says versions 1.0.3 through 1.2.0 are affected.
Which versions should I install?
Reported fixes include Brotli 1.0.10, 1.1.1 or 1.2.1; Node.js 22.23.4, 24.22.1 or 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Fixed releases also vary across Bun, Envoy, Istio, .NET and Linux distributions. Check the advisory for your exact product and release line.
Is updating enough, or must I restart?
Restart affected services after applying the fix. A process can retain the vulnerable decoder loaded in memory until it is restarted or redeployed.
Is Broccoli2Shell being exploited in the wild?
The source reports no known exploitation in the wild as of October 26, 2026, and says the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog then. That status may change and does not establish whether a particular system has been targeted.
Does upgrading Express fix the issue?
Not by itself, according to the source: the flaw is in Brotli, not Express. Applications using Brotli body decompression should identify and update the decoder dependency, then restart the affected process.
Source: ThorstenMeyerAI.com
