🔍 Read the full analysis: A Broccoli2Shell Checklist For Node.js, Python, And Other Environments on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has prompted fixes across Node.js, Python and other software. Maintainers have issued patched releases, but affected running processes need restarting, and some projects that bundle Brotli remained unfixed as of October 26, 2026. There is no confirmed evidence of exploitation in the wild in the source material.
Google’s Brotli decoder flaw CVE-2026-111497 has led to security updates across Node.js, Python and other software, after a crafted compressed stream was shown to corrupt memory and, in one demonstration, run code on an unmodified Node.js build. The vulnerability affects Brotli versions 1.0.3 through 1.2.0; maintainers have released patched versions, while some software that bundles its own copy remained unpatched as of October 26, according to the source’s tracker.
The flaw is an out-of-bounds write in Brotli’s C decoder. The Node.js advisory says the decoder handled certain malformed input as if it were incomplete and waiting for more data, rather than rejecting it. The resulting writes could exceed an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Memory corruption can cause a crash or expose data; code execution is a possible worst-case impact, not an outcome confirmed for every affected application.
The source lists fixes for Brotli 1.0.10, 1.1.1 and 1.2.1, and for Node.js versions 22.23.4, 24.22.1 and 26.12.1. It says Node.js 20, 23 and 25 do not receive a fix. Python’s Brotli package is fixed in 1.2.1 and brotlicffi in 1.2.1.0. Other listed updates include Bun 1.4.4, several Envoy and Istio releases, .NET runtime releases, and Debian packages. These version details come from the supplied October 26 report and should be checked against each project’s current advisory.
Exposure depends on how software uses Brotli. Node’s built-in fetch() can decode compressed responses; Python HTTP clients may do so when a Brotli package is installed. The source also identifies applications that accept compressed request bodies and tools that process compressed files. Updating a framework alone may not replace the vulnerable decoder: the report says the issue is in Brotli, not Express. After installing a fix, operators must restart affected processes so they stop using the old decoder.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli Patches Reach Many Stacks
The flaw matters because Brotli is reused across languages, runtimes and applications. A single decoder defect can therefore require fixes from many maintainers, rather than one update to one product. Teams may need to trace direct and transitive dependencies, check whether a runtime bundles its own decoder or uses a system library, and rebuild and restart affected services.
The difference between response decoding and request-body parsing also matters for exposure reviews. Software that fetches compressed content, accepts compressed bodies, or handles Brotli-compressed files may reach the vulnerable code through different paths. The source names webhooks, crawlers, link previews and URL-import features as examples to review; it does not establish that every deployment using these features is exploitable.
The source reports Google’s CVE score as 9.2, Critical under CVSS 4.0. It also says CISA’s data recorded exploitation as “none” and that the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog at the time. Those indicators describe the reported status on October 26; they do not rule out later exploitation or reduce the need to apply available fixes.
Products Worth Considering
Apple MacBook Pro 14-inch with M5 Max Chip (18-Core CPU, 20-Core GPU), 48GB RAM, 2TB SSD, Space Black
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Apple MacBook Pro 2021 16‑inch with M1 Max, 32 GB RAM, 2 TB SSD, Space Gray (QWERTY English)
As an affiliate, we earn on qualifying purchases.
From Brotli Commit to Runtime Updates
The supplied report says the underlying source-code change was committed on February 27, 2026, under the title “Detect and report invalid stream earlier.” The report says the commit did not identify the change as security-related. OpenAI said the security implications were not known at the time and that Brotli had no more recent release. The patched Brotli releases appeared on October 21, a 236-day gap between the source change and releases carrying it, according to the report.
The CVE became public on October 22, and a public proof of concept appeared on GitHub the same day, the source says. It reports that an independent tracker listed more than 30 projects and packages bundling their own copies. As of October 26, seven bundled copies were still marked unfixed on that tracker, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. The report says five other projects had fixes in their main branches, which does not necessarily mean released versions were already available.
Node.js credits OpenAI Codex Security in its advisory. OpenAI said it found the vulnerability during red-teaming with teams of AI agents. The supplied report also describes Imperva’s demonstration of code execution on an official Node.js image after several attempts. These are attributed findings and demonstrations, not evidence that attackers have used the flaw against systems in the wild.
“A “bigger deal than PHP2Shell” and comparable to “zlib 20 years ago.””
— Juliano Rizzo, security researcher, as quoted by the supplied report
Unpatched Bundles and Exploitation Status
The full set of affected products and versions remains a moving target because projects may bundle Brotli separately from operating-system or runtime libraries. The source’s tracker lists seven bundled copies as unfixed on October 26, but that count can change as maintainers publish updates. It also says some Linux distributions build Node.js against a system library, while official Node.js builds include their own copy; operators need to establish which arrangement applies to their deployment.
The supplied material reports no exploitation in the wild, citing CISA data marked “exploitation: none” and the CVE’s absence from CISA’s Known Exploited Vulnerabilities catalog. It does not establish that the flaw cannot be exploited beyond the cited Node.js demonstration. The report does not give a complete inventory of affected deployments, confirm which organizations have patched, or state when every remaining bundled copy will receive a release.
Patch, Restart and Track Releases
Operators should compare their installed runtime, Brotli library and package versions with the relevant vendor advisories, then apply the fixed release available for their platform. They should also check container images and system packages, since a dependency may be bundled rather than installed as a separately visible library. For Node.js, the supplied report lists fixes in versions 22.23.4, 24.22.1 and 26.12.1 and says versions 20, 23 and 25 receive no fix; teams on those lines should consult the project’s current support guidance for an upgrade path.
After updating, teams should restart affected services and workers, rebuild images where needed, and verify the running versions rather than relying only on a successful package update. Maintainers of still-unfixed bundled copies may publish releases or advisories, while security trackers can update their status. The source supplies no universal patch deadline or confirmed date for the remaining fixes.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used in the supplied report for the security issue involving CVE-2026-111497, a flaw in Google’s Brotli decoder. The reported defect can cause memory corruption when the decoder processes certain malformed compressed input.
Which versions are reported as vulnerable?
The source identifies Brotli 1.0.3 through 1.2.0 as affected. It lists Brotli 1.0.10, 1.1.1 and 1.2.1 as fixed releases, alongside fixes for Node.js, Python packages and other products. Check the relevant vendor advisory for the exact package and platform version.
Does updating Express fix the issue?
Not by itself, according to the supplied report. The flaw is in Brotli’s decoder, not Express. Applications using body-parser or other components to process Brotli bodies need to update the vulnerable decoder or a package that supplies it.
Is the vulnerability being exploited in the wild?
The source says CISA’s data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also describes a researcher demonstration of code execution; that is not the same as confirmed attacks in the wild.
Why must services restart after patching?
A running process can continue using the decoder loaded before the update. The supplied report says operators should restart affected processes after installing a fix so the patched code is active.
Source: ThorstenMeyerAI.com
