🔍 Read the full analysis: Broccoli2Shell: A Guide To Patching And Restarting Affected Services on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE-2026-111497, dubbed Broccoli2Shell, is a memory-corruption flaw in Google’s Brotli decoder that affects versions 1.0.3 through 1.2.0 and has fixes in multiple runtimes and packages. Administrators should identify bundled copies, update to a fixed release and restart affected services; no exploitation in the wild is confirmed in the cited records.
Security advisories and package releases are addressing CVE-2026-111497, a critical flaw in Google’s Brotli decoder that can corrupt memory when it processes malformed compressed data. The vulnerability affects decoder versions 1.0.3 through 1.2.0 and reaches services through runtimes and applications that bundle or use Brotli; administrators must install a fixed version and restart affected processes for the new decoder to take effect.
The flaw occurs when the decoder treats a malformed stream as though it is incomplete and continues processing it. According to the Node.js security advisory, this can cause writes beyond an internal eight-byte buffer. The CVE record lists an out-of-bounds write and an unchecked return value. Depending on the circumstances, memory corruption can crash a process, expose memory contents or potentially enable code execution. Those outcomes are risks, not evidence that every affected service can be exploited in the same way.
Fixed releases listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Fixes are also listed for Envoy, Istio, .NET and Debian packages. The precise release varies by product and branch, so operators should use the advisory for their specific distribution and confirm the installed version.
Updating a package alone may not change what an already-running service uses. A process can keep the vulnerable decoder loaded until it is restarted. Teams should check direct and transitive dependencies, container images, operating-system packages and applications that bundle Brotli separately, then redeploy or restart after patching. Node.js versions 20, 23 and 25 are listed as receiving no fix in the supplied guidance, so users of those branches need to consult current project support information for a migration or other mitigation path.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
How Brotli Reaches Production Services
The issue matters because Brotli is a shared compression component rather than a flaw limited to one application. A vulnerable decoder may be reached when software decompresses responses fetched from other services, processes compressed request bodies, or reads files and data formats that use Brotli. Node.js built-in fetch decodes Brotli responses automatically; Python clients can do so when a Brotli package is installed. The source also identifies Express and body-parser versions that inflate Brotli request bodies, while stressing that the defect is in the decoder, not Express itself.
That distribution makes an inventory harder than checking one named product. Some runtimes ship their own Brotli copy; others link against an operating-system library. A service may therefore remain affected even after an application-level package update if its container or bundled dependency still carries the old code. The operational takeaway is to trace the decoder through the full deployment chain and verify the running workload after changes.
The report gives Google’s CVE record a CVSS 4.0 score of 9.2, Critical. It also says Imperva demonstrated code execution against an unmodified official Node.js image after several attempts. That demonstration indicates potential severity, but it does not establish widespread exploitation. The source reports that CISA data listed exploitation as none and that the CVE was not in the Known Exploited Vulnerabilities catalog at the time of publication.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From February Fix to October Releases
The source reports that the underlying code change entered Brotli’s source repository on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says that change did not identify the issue as a security vulnerability at the time. Releases carrying the fix appeared on October 21, creating a reported 236-day gap between the source change and fixed releases. That interval matters because other projects may bundle a library without immediately receiving or recognizing a security fix.
The CVE became public on October 22, and the source says a public proof of concept appeared the same day. Fixes then had to be incorporated by downstream runtimes, packages and distributions. As of October 26, an independent tracker cited in the source listed more than 30 projects or packages with their own Brotli copies, including seven it said remained unfixed. The tracker is a snapshot, not a complete measure of every deployment, and its status can change as maintainers publish updates.
AI-assisted security work is part of the reported discovery story, but the details should be kept distinct from the technical advisory. Node.js credits OpenAI Codex Security; OpenAI said it found the flaw during red-teaming with teams of AI agents. OpenAI also said the February fix was not then known to create a security vulnerability and that no newer Brotli release was available. These statements describe the discovery and release timeline; they do not change which components need patching.
Exposure and Exploitation Still Vary
The available material does not establish how many internet-facing services are vulnerable, how many have been patched, or whether attackers have exploited the flaw outside controlled demonstrations. The cited CISA information showed no known exploitation and no listing in its Known Exploited Vulnerabilities catalog as of the report, but that status is time-sensitive and does not prove that exploitation is impossible.
Exposure depends on whether a particular product uses an affected decoder, whether it accepts or processes attacker-controlled compressed data, and whether a fixed build is available for its supported branch. The tracker’s listed unfixed projects may since have changed status, and bundled copies can be difficult to discover. The source also notes that some Linux distributions link Node.js to a system Brotli library while official Node.js builds bundle their own, so version checks must account for how each deployment was built.
The report mentions a separate DreamHost password reset incident but says DreamHost named no cause and provides no link to Brotli. The two developments should not be treated as connected based on the available information.
Verify Patches and Restart Workloads
Administrators should check the current advisories for their runtime, distribution and package manager, then inventory applications that decode compressed responses, request bodies or files. Patch to the vendor’s fixed version where available, rebuild affected images and restart or redeploy running services. For products without a published fix, teams should follow maintainer guidance, limit exposure to untrusted compressed input where practical and monitor for an update rather than assuming an unrelated application upgrade resolves the decoder flaw.
Security teams should repeat dependency and image scans after changes and confirm the version inside deployed workloads—not just in a development environment or lockfile. Downstream release status is still changing, particularly for projects that carry their own Brotli copy. The next useful milestone is confirmation from each affected maintainer that a fixed build is available and deployed; current exploitation reporting should also be checked as advisories evolve.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a memory-corruption vulnerability in Google’s Brotli decoder. The source reports that affected decoder versions range from 1.0.3 through 1.2.0.
Which versions contain fixes?
The source lists Brotli 1.0.10, 1.1.1 and 1.2.1, plus specific fixed releases for Node.js, Python packages, Bun, Envoy, Istio, .NET and Debian. Check the relevant vendor advisory because the correct version depends on the product and supported branch.
Why must services restart after patching?
A running process may keep the old decoder loaded in memory after files or packages are updated. Restarting or redeploying lets the service load the patched code; teams should verify the version in the running workload.
Is the flaw being exploited in the wild?
The supplied report says CISA data listed exploitation as none and the CVE was not in the Known Exploited Vulnerabilities catalog at publication time. Imperva reportedly demonstrated code execution in testing, but the source does not confirm real-world exploitation.
Does upgrading Express fix the issue?
Not by itself, according to the source. The vulnerability is in Brotli, which some Express and body-parser versions use to inflate compressed request bodies. Operators need to update the affected decoder or the runtime or package that supplies it, then restart the service.
Source: ThorstenMeyerAI.com
