🔍 Read the full analysis: Broccoli2Shell: What To Review Before And After Restarting Services on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Broccoli2Shell, tracked as CVE-2026-111497, is a memory-corruption flaw in Google’s Brotli C decoder that affects multiple runtimes and bundled copies. Fixes are available for several products, but a running process retains its old decoder until restarted; some projects remain unpatched, and no in-the-wild exploitation is reported in the supplied source.
Broccoli2Shell, a memory-corruption vulnerability in Google’s Brotli decoder tracked as CVE-2026-111497, has led to security fixes across Node.js, Python packages and other software that bundles the library. Operators need to identify affected components, install the appropriate patched versions and restart running services: an existing process continues using its old decoder until it restarts.
The vulnerability affects Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js advisory, malformed compressed input can be treated as incomplete rather than invalid, leading the decoder to write beyond an internal buffer. The CVE record lists an out-of-bounds write and an unchecked return value. Depending on the application and circumstances, memory corruption can cause a crash, expose memory contents or potentially permit code execution.
Fixes listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. These version numbers are product-specific: teams should check the advisory for the exact runtime, package or distribution they use. The source says Node.js 20, 23 and 25 do not receive fixes.
Restarting is a separate step from installing an update. A new package or image does not replace the decoder already loaded into a live process. Teams should confirm that patched code is deployed, restart affected services or workloads, and verify that the restarted instances are running the fixed versions. Where software bundles its own Brotli copy, updating a system library alone may not address it.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli’s Reach Raises the Stakes
The issue matters because Brotli is used across web and application stacks, and its decoder can be included indirectly. Node.js can automatically decode Brotli responses through its built-in fetch function. Python HTTP clients may do so when a Brotli package is installed; web servers and middleware can also decompress incoming request bodies. Other exposure paths include file-processing tools that read compressed archives, fonts, data files or firmware.
That broad use means a team cannot rely only on its direct dependency list or on a single application upgrade. The source reports that an independent tracker listed more than 30 projects and packages with bundled copies, and still identified seven unfixed copies as of October 26. A vulnerable component may sit in a runtime, container image, proxy or utility rather than the code developers maintain directly. The practical risk depends on whether an affected decoder processes attacker-controlled data and how that application handles memory corruption.
The CVE record gives the flaw a 9.2 Critical score under CVSS 4.0. That rating signals severity, not evidence that attacks are occurring. The source says CISA’s data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time of publication. Imperva reported running code on an official Node.js image after several attempts, a demonstration that should be distinguished from confirmed attacks in the wild.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Portable Waterproof Speaker, Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
From February Fix to October Releases
The source traces the underlying code change to February 27, 2026, when Brotli’s source repository received a fix titled “Detect and report invalid stream earlier.” It says the change did not mention security at the time. The first releases carrying the fix appeared on October 21, according to the account, a gap of 236 days. OpenAI said the security significance was not known when the change was made and that no newer Brotli release had been available.
The vulnerability became public on October 22, and the source reports that a public proof of concept appeared on GitHub that day. Fixes then had to pass through the software supply chain: from Brotli to runtimes and packages, then to distributions, container images and deployed processes. On October 23, the source says Python packages were missing from advisory databases earlier in the day, which could leave dependency scanners without an alert; GitHub’s advisory was added later.
The source also notes that Node.js credited OpenAI Codex Security and that OpenAI described finding the flaw during red-teaming with teams of AI agents. That attribution concerns how the vulnerability was found; it does not change which software versions are affected or confirm exploitation. The article identifies a separate DreamHost password-reset incident but says the company named no cause and provides no link between that incident and Brotli.
“The source describes malformed input being treated as “waiting for more data” instead of “this is broken.””
— Node.js project
Exposure and Exploitation Still Vary
The available information does not establish how many services have been attacked or whether any attacks have occurred in the wild. The source reports no known exploitation in CISA’s data and no listing in the agency’s Known Exploited Vulnerabilities catalog as of October 26, but those details do not prove that misuse is impossible or that every environment has been checked. The demonstration reported by Imperva is not, by itself, evidence of a real-world campaign.
It is also not clear from the source which deployments in any particular organization process untrusted Brotli data, or whether all bundled copies have received fixes. The tracker still listed seven unfixed projects on October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. Status can change as maintainers publish releases. Teams should consult current advisories rather than assume the listed status remains current.
Verify Patches and Restarted Workloads
Operators should inventory services, runtimes, libraries and tools that use Brotli, including indirect dependencies and bundled copies. Match each component to its vendor advisory and supported fixed release; do not assume that upgrading Express alone fixes Brotli in a body-parser path, or that updating an operating-system library changes a runtime that bundles its own copy.
After updating, rebuild or redeploy affected images where needed, restart processes and workloads, and verify the version actually loaded by each running instance. Continue checking maintainer advisories for components that were still listed as unpatched, and review whether the software processes compressed data from untrusted sources. The source gives no single deadline or universal restart procedure; those steps depend on the affected product and service.
Key Questions
What is Broccoli2Shell?
It is the name used for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The affected versions listed in the source are 1.0.3 through 1.2.0.
Does installing a patch protect a service that is already running?
Not necessarily. A running process can keep its previously loaded decoder. Apply the relevant product update, then restart the affected process or workload and confirm it is using the patched version.
Which Node.js versions have fixes?
The source lists fixes in Node.js 22.23.4, 24.22.1 and 26.12.1. It says Node.js 20, 23 and 25 do not receive a fix, so users of those versions should consult the project’s current guidance about supported upgrade paths.
Is Broccoli2Shell being exploited in the wild?
The supplied source reports no known in-the-wild exploitation in CISA’s data as of October 26, 2026, and says the CVE was not in CISA’s Known Exploited Vulnerabilities catalog. It also describes an Imperva code-execution demonstration, which is not the same as a confirmed attack campaign.
Can updating my operating system fix every affected copy?
No. Some products bundle their own Brotli decoder, while others use a system library. Check each runtime, package, container and tool against its own advisory; a system-library update may not replace a bundled copy.
Source: ThorstenMeyerAI.com
