🔍 Read the full analysis: How To Respond To Broccoli2Shell Across Node.js, Python, And Beyond on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A memory-corruption flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has prompted fixes across Node.js, Python and other software. Administrators should update affected components and restart processes; several bundled copies remain unfixed, and authorities report no known exploitation in the wild.
Fixes are spreading for CVE-2026-111497, a critical flaw in Google’s Brotli decompression library that can cause memory corruption when software processes crafted compressed data. The affected decoder is used in Node.js, Python packages and other runtimes; maintainers and operators need to update affected components and restart running services, while some projects that bundle their own copy still lack a released fix.
The flaw affects Brotli versions 1.0.3 through 1.2.0. According to the Node.js advisory, the decoder mishandled malformed input as though it were incomplete, allowing data to be written past an eight-byte internal buffer. The resulting memory corruption could crash a process or, in the worst case, enable code execution. Google’s CVE record identifies an out-of-bounds write and an unchecked return value.
Published fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. These version numbers come from the October 26 source report; operators should check the advisory for their specific distribution and deployment.
Updating alone may not be enough: a process can keep using the old decoder until it restarts. Official Node.js builds include their own Brotli copy, while some Linux builds use the system library, so the relevant update can depend on how Node.js was installed. Express and body-parser versions listed as affected may expose the flaw when they inflate Brotli request bodies, but the defect is in Brotli itself; upgrading Express alone does not fix an unpatched decoder.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Stacks
The risk reaches beyond a single language because Brotli is embedded in or called by many kinds of software. Potential exposure paths include automatically decoded web responses, Brotli-compressed request bodies accepted by applications, and tools that process compressed files. Python clients such as requests with urllib3, aiohttp, httpx with its Brotli extra, and Scrapy may use a Brotli package when installed. Webhooks, link previews, crawlers and URL-import features can therefore warrant review if they process compressed responses.
For defenders, the practical challenge is tracing the decoder through the software supply chain: a library may be bundled inside a runtime, package, container or utility rather than listed as a direct dependency. The source report says an independent tracker listed more than 30 projects and packages bundling their own copy, with seven still unfixed as of October 26. This makes inventory and restart checks as important as applying a top-level package update.
The CVE record assigns the issue a CVSS 4.0 score of 9.2, rated Critical. That severity describes the assessed potential impact, not evidence of active attacks. The source report says CISA’s data listed exploitation as none and that the CVE was not in the Known Exploited Vulnerabilities catalog at the time of publication.
Popular right now
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
As an affiliate, we earn on qualifying purchases.
From Source Fix to Security Release
The report dates the underlying source-code change to February 27, 2026, 236 days before releases containing the fix appeared on October 21. The change was titled “Detect and report invalid stream earlier” and did not identify the issue as a security vulnerability. OpenAI said the security implications were not known then and that no newer Brotli release was available at the time.
The CVE became public on October 22, and the report says a public proof of concept appeared on GitHub that day. Node.js credited OpenAI Codex Security, while OpenAI said the issue was found during red-teaming with teams of AI agents. Those accounts describe how the flaw was identified; they do not change the need for maintainers to ship fixes through downstream projects.
Node.js releases 20, 23 and 25 are listed as receiving no fix. The report also says seven projects with bundled copies remained unfixed on October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. Five additional projects had fixes in their main branches, which may not yet mean a fixed release is available.
“The decoder treated malformed input as “waiting for more data” instead of “this is broken.””
— Node.js security advisory, as summarized by ThorstenMeyerAI.com
Remaining Bundled Copies and Exposure
Some downstream components still lack released fixes. The source report’s count and list were current as of October 26, 2026, and may change as maintainers publish updates. A fix in a project’s main branch is not necessarily available in a stable package or in software already deployed by users.
It is also not clear from the supplied material how many systems are actually exposed or whether attackers have exploited the flaw. The report says CISA data showed “exploitation: none” and that the CVE was absent from the KEV catalog, but that is a status snapshot, not proof that exploitation is impossible. Imperva reportedly ran code on an official Node.js image after several attempts; the source does not establish that this demonstration represents attacks in the wild.
Exposure depends on whether an application processes attacker-controlled Brotli data and which decoder it uses. A package’s presence alone may not establish that the vulnerable path is reachable. DreamHost’s separate password resets for some email and FTP/SFTP accounts were also mentioned in the source; the company named no cause, and no connection to the Brotli flaw was established.
Patch, Restart and Check Dependencies
Teams should identify Brotli versions across runtimes, Python environments, operating-system packages, containers and tools that bundle dependencies. Apply a fixed release appropriate to each component, then restart affected processes so they load the updated decoder. Where a runtime version has no listed fix, consult its vendor’s current security guidance and assess whether it can be replaced or isolated while a supported update is unavailable.
Operators should check vendor advisories and package repositories for projects that had no release on October 26, including bundled copies and fixes that were only in a main branch. Security teams can review services that decode untrusted responses or accept compressed request bodies, but should not assume every installation is reachable or vulnerable in the same way. The next confirmed milestone is the publication of further downstream releases and updated advisories; the supplied report does not give a schedule for those releases.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for the security issue involving CVE-2026-111497, a flaw in Google’s Brotli decoder. The reported bug can cause memory corruption when the decoder handles crafted malformed compressed data.
Which versions are listed as fixed?
The source report lists Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0. It also lists updates for Bun, Envoy, Istio, .NET and Debian. Confirm the correct version with the relevant vendor or distribution advisory.
Does upgrading Node.js or a Python package require a restart?
Yes, running processes should be restarted after the relevant update so they load the patched decoder. The affected component may be bundled in a runtime or supplied by the operating system, so check how the software was installed.
Is the vulnerability being exploited in the wild?
The supplied report says CISA’s data listed exploitation as none and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also describes a code-execution demonstration by Imperva. That demonstration is not, by itself, evidence of exploitation in real-world attacks.
Are all affected projects patched?
No. The report said seven projects with bundled Brotli copies remained unfixed as of October 26, while five more had fixes in their main branches. Availability can change, so check each project’s current advisory and release status.
Source: ThorstenMeyerAI.com
