🔍 Read the full analysis: Broccoli2Shell Response: Locate, Patch, Restart, And Verify on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has fixes in multiple libraries and runtimes. A security demonstration ran code on an unmodified Node.js build, but CISA data cited by the source reports no known exploitation in the wild. Organizations need to identify every bundled copy, update to a fixed release, restart affected processes, and verify the running versions.
Security fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are now available across several runtimes and packages, but affected services must be restarted after patching to load the updated code. The vulnerability affects Brotli versions 1.0.3 through 1.2.0; a reported demonstration achieved code execution on an unmodified Node.js build, while the source material says CISA data lists no exploitation in the wild.
The flaw arises when the decoder treats malformed compressed input as data that is still arriving rather than as an invalid stream. According to the Node.js advisory cited by ThorstenMeyerAI.com, the decoder can then write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on circumstances, memory corruption can cause a crash, expose memory contents, or potentially allow code execution.
Fixed versions listed in the report include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updated releases of Envoy, Istio and .NET. Debian security updates are also listed. Node.js 20, 23 and 25 are identified as receiving no fix, so users of those versions should consult their vendor’s guidance rather than assume a routine upgrade is available.
The weakness is in the shared decoder, not necessarily in the framework that exposes it. Node.js can decode Brotli responses through its built-in fetch function, while Python HTTP clients may do so when a Brotli package is installed. Some request parsers also decompress Brotli bodies. The report says official Node.js builds bundle Brotli, while some Linux distributions use a system library, making the actual component to update dependent on how the software was built and deployed.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli Copies Expand Exposure
Brotli is used to compress web traffic and is also present in tools that process files. That places the same decoder in many languages, services and bundled applications, so updating one central package may not remove every vulnerable copy. An organization may need to check application dependencies, runtime versions, operating-system packages, container images and standalone tools.
The report describes several possible exposure paths: applications fetching compressed responses, services accepting compressed request bodies, and software unpacking or processing files. These are examples of where the decoder may be used, not evidence that every such system is vulnerable or reachable by an attacker. The key operational point is that a patched package does not change code already loaded by a running process; restart and verification are part of remediation.
The CVE is scored 9.2, Critical, under CVSS 4.0, according to the source. Imperva reportedly ran code on an official Node.js image after several attempts. That demonstration indicates potential severity, but it does not establish widespread exploitation. The source says CISA’s data reports “exploitation: none” and that the CVE is not in CISA’s Known Exploited Vulnerabilities catalog.
Products Worth Considering
DJI Osmo Mobile 8 3-Axis Smartphone Gimbal Stabilizer
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Portable Waterproof Speaker, Black
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Multiple Stacks
The underlying correction was committed to Brotli’s source code on February 27, 2026, under the title “Detect and report invalid stream earlier.” The report says the commit did not identify the change as security-related. Releases carrying the fix arrived on October 21, a gap of 236 days. OpenAI said the security implications were not known at the time and that no newer Brotli release had been available.
The CVE became public on October 22, and the report says a public proof of concept appeared on GitHub the same day. Patches then had to move through projects that bundle the decoder, as well as package and distribution releases. By October 26, the report’s tracker listed seven bundled copies still unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. It also said five more had fixes in their main branches, which does not necessarily mean users had received released updates.
Node.js credits OpenAI Codex Security, and OpenAI said it found the flaw during red-teaming with teams of AI agents. The source also quotes security researcher Juliano Rizzo describing the issue as “a bigger deal than PHP2Shell” and comparing it to “zlib 20 years ago.” Those remarks are attributed assessments, not independent measures of impact. A separate DreamHost password-reset incident mentioned in the source has no stated connection to Brotli.
Unfixed Bundles and Exploitation Status
The full set of affected software remains unsettled. The source’s tracker listed more than 30 projects or packages that bundle Brotli and seven copies without a fix as of October 26, but maintainers may publish updates or add affected products. The report does not provide a complete inventory of every deployed copy or confirm the status of every downstream package.
It is also not clear from the supplied material whether attackers have exploited the flaw outside the reported demonstration. CISA data is described as showing no known exploitation, and the CVE is absent from the agency’s Known Exploited Vulnerabilities catalog. That is a statement about the available tracking data, not proof that exploitation is impossible or that every environment is unaffected. The source gives no confirmed victim count or evidence of an active campaign.
Some dependency scanners may not have flagged all affected Python packages immediately: the report says that on October 23 no advisory database listed them, before GitHub’s advisory was added later that day. Current scanner coverage and the status of individual Linux distribution, container and application releases should be checked against maintainers’ advisories.
Patch, Restart, Then Verify
Administrators should inventory software that uses Brotli, including direct dependencies, runtimes, system libraries and bundled copies in containers or standalone tools. They should compare each installed component with the fixed versions listed by its vendor, apply the appropriate update, and restart affected processes. Updating a package on disk alone may leave a long-running service using the vulnerable decoder already loaded in memory.
After restarting, teams should verify the version actually running and confirm that deployed images or hosts contain the fixed component. Where a project has not published a release, maintainers’ advisories should guide interim decisions; the source material does not prescribe a single mitigation for every product. Teams should also recheck vendor notices as fixes continue to move through downstream projects.
The next developments to watch are updates from projects whose bundled copies were still listed as unfixed, and any change in public exploitation reporting. Until those details are clearer, the documented priority is to locate affected copies, patch them, restart services and verify the deployed state.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for the Brotli decoder vulnerability tracked as CVE-2026-111497. The flaw can cause an out-of-bounds memory write when the decoder processes certain malformed input.
Which versions are listed as affected?
The source report identifies Brotli versions 1.0.3 through 1.2.0 as affected. Products may bundle their own copy, so checking only a system-wide Brotli installation may not find every instance.
Does installing a patch finish the remediation?
No. A running process may continue using the decoder it loaded before the update. The report advises administrators to restart affected processes and then verify the version in the deployed system.
Is the vulnerability being exploited in the wild?
The supplied report says CISA data lists “exploitation: none” and that the CVE is not in the Known Exploited Vulnerabilities catalog. It also describes a code-execution demonstration, which is not the same as confirmed real-world exploitation.
What if a product does not have a listed fix?
Check the product maintainer’s current advisory and release information. The report lists several bundled copies as still unfixed on October 26, 2026, so users should not assume that a fix for Brotli or a related runtime automatically updates every bundled component.
Source: ThorstenMeyerAI.com
