🔍 Read the full analysis: Could A Compression Bug Cross Your Stack? Understanding Broccoli2Shell on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption vulnerability in Google’s Brotli C decoder affects versions 1.0.3 through 1.2.0 and has been carried into multiple runtimes and applications. Patches are available for several widely used projects, but some bundled copies remain unfixed; the supplied source reports no known exploitation in the wild.
A flaw in Google’s Brotli decoder can corrupt memory when software processes specially crafted compressed data, prompting security updates across Node.js, Python and other projects. The vulnerability, tracked as CVE-2026-111497, affects Brotli C decoder versions 1.0.3 through 1.2.0; patches are available for several major users, while some projects that bundle their own copies remain unpatched, according to the supplied security report.
The flaw occurs when the decoder treats malformed compressed input as incomplete data and continues processing it. According to the Node.js security advisory cited in the report, that behavior can cause writes beyond an eight-byte internal buffer. The resulting memory corruption could crash a process, expose memory contents or, in a severe case, allow code execution. The CVE record identifies an out-of-bounds write and an unchecked return value. These are potential consequences; the source does not say every affected use is exploitable in the same way.
The report says Google’s CVE record assigns the issue a CVSS 4.0 score of 9.2, classified as Critical. Imperva demonstrated code execution on an unmodified Node.js build after several attempts, according to the source. That demonstration establishes a risk in that test environment, but the report says CISA data lists exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26. Those indicators do not prove that no private or unreported attack has occurred.
Fixes listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. Version support differs by product: the report says Node.js 20, 23 and 25 have no fix. Because a running process continues using its loaded decoder, patching also requires restarting affected processes.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Stacks
Brotli is widely used to compress web traffic, so a weakness in its decoder can reach beyond one application or programming language. The report identifies exposure paths that include software fetching compressed responses, services that accept compressed request bodies, and tools that process files. Node.js’s built-in fetch can decode Brotli responses automatically; Python HTTP clients may do so when a Brotli package is installed. Express body parsers can also inflate Brotli request bodies in certain versions, although the underlying defect is in Brotli, not Express.
This makes the issue a software supply-chain problem: a fix to the original library must reach every runtime, package, distribution, container image and deployed process that contains the vulnerable code. Updating a top-level framework alone may not replace a bundled decoder. The report’s tracker listed more than 30 projects and packages that bundle their own copies, with seven still unfixed as of October 26. That count is a tracker observation, not a measure of how many systems are exposed.
For operators, the practical concern is whether untrusted or externally supplied compressed data reaches an affected decoder. The source describes a range of possible uses, but does not establish that every listed integration accepts attacker-controlled input. Teams need to check their actual dependency and data flows rather than infer exposure solely from a product name. Security updates and restarts reduce the risk where a vulnerable decoder is present; they do not, by themselves, establish whether a system was previously targeted.
Products Worth Considering
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
From Source Fix to Public Disclosure
The report traces the underlying code change to a Brotli source commit dated February 27, 2026, titled “Detect and report invalid stream earlier.” It says the change did not identify itself as a security fix at the time. OpenAI later said the vulnerability was not known then to arise from the change and that Brotli had no more recent release. Releases containing the fix appeared on October 21, according to the report: a gap of 236 days between the source change and those releases.
The CVE became public on October 22, and the source says a public proof of concept appeared on GitHub that day. Patches then began moving into downstream projects. The report says Node.js credited OpenAI Codex Security, while OpenAI described finding the flaw during red-team work with teams of AI agents. That attribution concerns discovery; it does not change the need for maintainers and users to verify which versions contain the fix.
The issue has also been given the name “Broccoli2Shell.” The source attributes comparisons with other recent vulnerabilities to researcher Juliano Rizzo, who called it “a bigger deal than PHP2Shell” and compared it to “zlib 20 years ago.” These are his assessments, not findings that determine the vulnerability’s actual reach. The same report notes that some dependency scanners did not list the Python packages in their advisory databases on October 23, illustrating how disclosure and package-level tracking can lag behind one another.
Exposure and Unfixed Copies
The source reports no known exploitation in the wild as of October 26, citing CISA data and the CVE’s absence from the Known Exploited Vulnerabilities catalog. That is a status report, not proof that exploitation has not occurred. The supplied material does not identify any confirmed attack victim, stolen data or incident tied to this CVE.
It also does not establish how many deployed services are vulnerable or which are reachable by malicious input. The source says seven bundled copies remained unfixed in its tracker, including copies associated with DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. A tracker entry does not necessarily mean a particular installation is exposed: product versions, configuration and whether untrusted data reaches the decoder matter. Some projects had fixes in their main branches but had not necessarily shipped a release.
The report’s version list is a snapshot and may change as maintainers publish updates. It does not provide a complete, independently verified inventory of every affected package or operating system. Readers should consult current vendor advisories for their installed versions, including whether their distribution uses a system Brotli library or a separately bundled copy.
Patch Releases and Process Restarts
Organizations should use vendor advisories and software inventories to identify affected Brotli versions, update to a fixed release where one is available, and restart processes that load the decoder. The source’s version list is a starting point, not a substitute for checking each product’s current guidance. Node.js users should pay particular attention to the specified supported release lines; the report says versions 20, 23 and 25 do not receive a fix.
Teams should also check indirect dependencies and bundled libraries, rather than assuming an update to an application framework replaces Brotli. Where a project has not shipped a fixed version, maintainers’ advisories or release pages will be needed to establish the available mitigation and timetable. The supplied material does not specify a universal workaround for all affected products.
The next indicators are additional downstream releases, updates to vulnerability databases and changes in reports of exploitation. The source identifies no confirmed in-the-wild attacks as of October 26, but that status could change. For now, the confirmed operational step is to verify affected components, apply the appropriate vendor fixes and reload the processes that use them.
Key Questions
What is Broccoli2Shell?
It is the name used in the supplied report for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The defect affects decoder versions 1.0.3 through 1.2.0, according to the report.
Does the flaw affect only Node.js?
No. The underlying decoder is used by or bundled into several runtimes and projects. The report lists affected or patched components including Node.js, Python Brotli packages, Bun, Envoy, Istio, .NET and Debian. Actual exposure depends on the installed version and how the software processes compressed data.
What should affected teams do?
Check vendor advisories and dependency inventories, update affected components to a fixed version where available, and restart processes so they load the patched decoder. Also check for bundled copies that may not be updated when a top-level package changes.
Is Broccoli2Shell being exploited?
The supplied report says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It reports a code-execution demonstration by Imperva, but no confirmed attacks in the wild. The absence of a public listing does not rule out unreported activity.
Why might a patch not appear in my dependency scanner?
Security advisories and package databases can update at different times. The source says some advisory databases did not list the affected Python packages on October 23, before GitHub’s advisory was added later that day. Check current vendor and package-maintainer notices as well as automated scanner results.
Source: ThorstenMeyerAI.com
