🔍 Read the full analysis: Broccoli2Shell: Practical Next Steps For Node.js, Python, And Beyond on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
CVE-2026-111497 affects Google’s Brotli C decoder and projects that bundle or use vulnerable versions, including Node.js and Python packages. Fixes are available for several runtimes and tools, but running processes need a restart to load updated code; some bundled copies remain unfixed.
Security fixes for CVE-2026-111497, a critical flaw in Google’s Brotli compression decoder, are available for Node.js, Python packages and several other projects, but operators must update affected software and restart running processes to load the fixes. The vulnerability can cause memory corruption when a decoder handles specially malformed compressed data; Imperva reported running code in a demonstration using an official Node.js image.
The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js security advisory, the decoder could treat malformed input as if it were incomplete, then write beyond an eight-byte internal buffer. The result can include a crash or memory exposure; code execution is a potential severe outcome, not a confirmed consequence in every affected application.
Fixes are listed for Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updated releases of Envoy, Istio and .NET. The source material says Node.js 20, 23 and 25 have no fix. Operators should check the affected component and its supported release path rather than assume a framework update alone is sufficient.
The vulnerable code can reach applications through several routes. Node.js’s built-in fetch decodes Brotli responses, while Python clients may do so when a Brotli package is installed. Some body parsers also inflate compressed requests, and software that processes Brotli-compressed files may use the decoder. A bare Node.js HTTP server does not decode request bodies automatically, and the source says the issue is in Brotli, not Express itself.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Stacks
The issue matters because a shared low-level library can affect products that users do not recognize as Brotli-dependent. A service might receive compressed responses, accept compressed request bodies or process files through a bundled decoder. That makes an inventory of runtimes, packages, containers and embedded copies more useful than checking only an application’s direct dependencies.
Updating a package is not the whole response: running processes retain the decoder already loaded until they restart. Teams need to deploy the corrected version and cycle relevant services or workloads. The source also reports that some projects maintain bundled copies of Brotli, so a system library update may not fix every application.
The severity rating is high: Google’s CVE record assigns the issue CVSS 4.0 score 9.2, Critical. At the same time, the supplied material says CISA’s data lists exploitation as “none,” and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. Those points describe the reported status, not a guarantee that exploitation cannot occur.
Products Worth Considering
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Downstream Projects
The decoder change was committed to Brotli’s source on February 27, 2026, under the title “Detect and report invalid stream earlier,” according to the source account. It was not identified as a security fix at the time. Releases carrying the change appeared on October 21, and the CVE became public the next day. The source characterizes the interval between the code change and those releases as 236 days.
That release history matters because Brotli is copied or packaged across language runtimes, proxies and tools. After a shared-library fix is published, maintainers still need to update their own releases, and those updates must then reach package repositories, distributions and deployed images. The source cites an independent tracker listing more than 30 projects and packages with bundled copies; as of October 26, it listed seven bundled copies still unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools.
The discovery also involved AI-assisted security work. Node.js credits OpenAI Codex Security, and OpenAI said the flaw was found during red-teaming with teams of AI agents. That attribution concerns how the issue was found; it does not change the need to verify and deploy fixes in each affected product.
Exposure and Remaining Vulnerable Copies
Actual exploitation in the wild is not established by the supplied material. It reports no known exploitation in CISA’s data and says the CVE is absent from the agency’s Known Exploited Vulnerabilities catalog. Imperva’s reported code-execution demonstration shows a possible outcome under its test conditions, but does not establish that attackers have used the flaw against live systems.
The full set of affected deployments is also still developing. Projects may bundle their own decoder, and the listed tracker reflects a snapshot from October 26, 2026. The source names seven bundled copies it says remained unfixed, but does not provide a complete inventory of all products or versions that use them. It is not yet clear when every downstream project will publish a fix.
Patch Releases and Service Restarts
Operators should identify where Brotli decoding occurs, check the runtime or package version against its vendor advisory, and move to a fixed release where one is available. For Node.js, the source lists fixes in 22.23.4, 24.22.1 and 26.12.1; it says versions 20, 23 and 25 have no fix. Python users should check whether Brotli or brotlicffi is installed and update to the listed corrected releases.
After deployment, teams should restart affected processes and rebuild or replace container images that include vulnerable copies. They should also track advisories from projects that bundle Brotli rather than relying only on operating-system package updates. The next concrete milestone is the release of fixes for the remaining affected copies; the supplied material does not give a date for those releases.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a vulnerability in Google’s Brotli C decoder. Malformed compressed input can trigger an out-of-bounds write, causing memory corruption and, in some circumstances, potentially more serious effects.
Which Node.js versions have a listed fix?
The source lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed releases. It says Node.js 20, 23 and 25 have no fix; check current Node.js security guidance for the applicable support path.
Does updating a package fix an already-running service?
Not by itself. The source says a running process continues using its existing decoder until it is restarted. Deploy the fixed software and restart affected processes.
Is the flaw being exploited in the wild?
The supplied source reports no known exploitation in CISA’s data and says the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. That is the reported status as of October 26, 2026, and does not rule out future or unreported activity.
Are all affected projects patched?
No. The source says an independent tracker listed seven bundled copies still unfixed as of October 26, 2026, while other projects had fixes or changes in their main branches. Downstream status can change, so check advisories for each product that includes Brotli.
Source: ThorstenMeyerAI.com
