🔍 Read the full analysis: Broccoli2Shell: Track The Bug From Compression Libraries To Your Services on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE-2026-111497 is a memory-corruption flaw in Google’s Brotli decoder, with fixes released across several runtimes and packages. A demonstration achieved code execution on an unmodified Node.js build, but CISA reports no known exploitation in the wild. Organizations need to identify bundled copies, apply the relevant fixes and restart affected processes.
Security fixes are rolling out for CVE-2026-111497, a critical flaw in Google’s Brotli compression decoder that affects software including Node.js and Python packages. Imperva reported code execution in a demonstration using an unmodified Node.js build, while CISA’s data lists no known exploitation; affected services need patched components and a restart to stop using the vulnerable decoder.
The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js advisory, malformed compressed input could be treated as data that had not yet finished arriving, rather than rejected as invalid. The decoder could then write beyond an eight-byte internal buffer, causing memory corruption. The CVE record identifies an out-of-bounds write and an unchecked return value.
Memory corruption can crash a process or expose memory; code execution is a possible severe outcome. Imperva said it achieved code execution after several attempts against an official Node.js image. That demonstration establishes a risk in that test environment, not evidence that attackers have exploited the vulnerability against live services. Google’s CVE record assigns it a 9.2 Critical score under CVSS 4.0.
Fixes are available in Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and listed releases of Envoy, Istio and .NET. These version numbers differ because projects ship the decoder through separate packages or bundled copies. The source material says Node.js 20, 23 and 25 have no fix listed.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Services
Brotli is widely used to reduce the size of data sent over networks, and the same decoder can enter a service through a runtime, a package dependency or a bundled copy. That broad distribution means checking only a project’s direct dependencies may miss affected code. The article’s tracker lists more than 30 projects and packages that bundle their own Brotli copy, with some still awaiting fixes as of October 26.
Exposure depends on what software does with compressed input. Node.js’s built-in fetch() decodes Brotli responses automatically; Python HTTP clients can do so when a Brotli package is installed. The source also identifies Brotli request-body parsing in specified Express and body-parser releases, as well as tools that process archives, fonts, Parquet files or firmware. The bug is in Brotli, not Express, so upgrading Express alone does not address it.
A patch also does not change code already loaded by a running process. Operators must verify the actual runtime or bundled library in use, update it and restart affected services. The consequence is operational as well as technical: remediation can involve application dependencies, base images, system packages and deployments, not just one library upgrade.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Fix Spent Months Unreleased
The flaw’s underlying source-code change was committed on February 27, 2026, according to the article’s review of the Brotli repository. The change was titled “Detect and report invalid stream earlier.” The source reports that the patch did not identify the change as security-related at the time. Releases containing the fix appeared on October 21, a gap of 236 days.
The CVE became public on October 22, and a public proof of concept appeared on GitHub that day, according to the cited tracker. After disclosure, projects began publishing updates for their own packages and bundled copies. The chain can run from the Brotli library through a language runtime or distribution package to a container image and finally a running process.
Node.js credits OpenAI Codex Security; OpenAI said the flaw was found during red-teaming with teams of AI agents. That account describes how the vulnerability was discovered, but does not change the remediation needed by users. The source also notes that on October 23 some Python package advisories were absent from an advisory database, leaving dependency scanners without those entries until the advisories were added later that day.
Exposure Depends on Bundled Copies
The source says CISA’s data lists “exploitation: none” and that the CVE was not in the Known Exploited Vulnerabilities catalog as of October 26. Those indicators do not prove that exploitation is impossible or that every affected system is safe. The reported Node.js demonstration shows code execution was possible in a test, but the source provides no evidence of attacks in the wild.
It is not yet clear which organizations have deployed affected versions or how many services process attacker-controlled Brotli data. The article’s tracker lists seven bundled copies as still unfixed on October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools; it says five other projects had fixes in their main branches. A fix in a main branch does not by itself confirm that a corrected release has reached users.
The exact exposure also varies by build. Official Node.js binaries bundle Brotli, while some Linux distributions build Node.js against a system library. Teams need to check their own distribution, runtime and deployment rather than assume one version list covers every installation.
Patch, Rebuild and Restart
Operators should inventory Brotli through direct dependencies, runtimes, operating-system packages, container images and tools that process compressed files. They should compare installed versions with the relevant vendor advisories, update to a fixed release where available, rebuild or refresh affected images and restart running processes. For software without a published release, teams will need to monitor the maintainer’s advisory and avoid treating an upstream main-branch fix as a shipped update.
Maintainers are still moving fixes through projects that bundle their own copies. The next milestones are corrected package and distribution releases, updated images, and confirmation that affected services have loaded the patched decoder. The source reports no confirmed in-the-wild exploitation as of October 26; that status could change as monitoring and investigation continue.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for the issue involving CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The name does not describe a separate vulnerability from the CVE.
Does the flaw affect every Node.js installation?
The source identifies affected Node.js releases and says official builds bundle Brotli, while some Linux distributions use a system library. Check the specific Node.js version and how it was built; Node.js 20, 23 and 25 have no fix listed in the supplied material.
Is the vulnerability being exploited in the wild?
The source reports no known exploitation: CISA’s data says “exploitation: none,” and the CVE was not listed in its Known Exploited Vulnerabilities catalog as of October 26, 2026. Imperva’s reported code-execution demonstration was a test, not evidence of a live attack.
Is upgrading Express enough to fix the issue?
No. The source says specified Express and body-parser versions can use Brotli when parsing request bodies, but the flaw is in the Brotli decoder. The relevant Brotli dependency or bundled runtime must be updated; an Express-only upgrade does not fix that component.
Why must services restart after patching?
A running process can keep using the decoder it loaded before the update. Restarting the affected process lets it load the patched component; teams should also check that the deployed runtime or image actually contains the fixed version.
Source: ThorstenMeyerAI.com
