🔍 Read the full analysis: Compression Bug Response: Patch And Verify Your Broccoli2Shell Exposure on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has fixes in Brotli and several runtimes. The source reports a code-execution demonstration on an unmodified Node.js build, but says there is no confirmed in-the-wild exploitation. Operators should update affected components and restart processes; some bundled copies remain unfixed.
Security fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are now available across several runtimes and packages, but affected applications must be updated and restarted to stop using the vulnerable decoder. The flaw, dubbed Broccoli2Shell, affects Brotli versions 1.0.3 through 1.2.0; the source reports a code-execution demonstration on an unmodified Node.js build, while saying there is no confirmed exploitation in the wild.
The vulnerability is in the Brotli C decoder, not in Node.js or Express itself. According to the Node.js advisory summarized by Thorsten Meyer, malformed compressed input can be treated as incomplete rather than invalid. The decoder may then write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on the affected application and conditions, memory corruption can cause a crash, expose memory contents or potentially enable code execution.
Fixes listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and patched releases of Envoy, Istio and .NET. The source says Node.js versions 20, 23 and 25 have no fix. It also lists patched Debian packages. Administrators should check vendor advisories for their exact release and support status rather than assume every product using Brotli is covered by the same update.
A patch alone may not change what a running service uses: processes need restarting after the relevant library or runtime is updated. Exposure depends on how the component handles compressed data. Examples in the source include automatic decoding of fetched responses, applications that accept compressed request bodies, and tools that process Brotli-compressed files. A bare Node.js HTTP server does not decode request bodies on its own, the source notes; using Express does not itself fix a vulnerable Brotli dependency.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Patches Must Reach Every Runtime
The flaw matters because Brotli is embedded across many languages, services and products. A security update to one package does not automatically repair every copy bundled into a runtime, proxy, application or utility. Operators need to identify the actual component in use, apply its applicable vendor fix, and restart the process or replace the affected image where needed.
The potential impact varies with exposure. An application that decodes attacker-controlled compressed data may face greater risk than a system that does not process such input. The source reports that Imperva demonstrated code execution against an official Node.js image after several attempts, but that is a research demonstration, not evidence that attackers are exploiting the flaw broadly. The distinction matters for prioritizing remediation without overstating the current threat.
The source also says OpenAI credited Codex Security in connection with the Node.js work and described discovery during red-teaming with teams of AI agents. That account is relevant to how the issue was found, but it does not change the patching task for operators or establish that AI-assisted review will find every similar defect.
Popular right now
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
As an affiliate, we earn on qualifying purchases.
A Long Gap Before Releases
The source says the underlying Brotli change was committed on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says the change did not identify a security issue at the time. Releases carrying the fix appeared on October 21, a gap of 236 days; the CVE became public on October 22, according to the article. OpenAI said on X that the vulnerability was not known when the change was made and that Brotli had not had a more recent release.
After disclosure, the fix had to move through a chain of projects that bundle or depend on Brotli. The source reports that a public proof of concept appeared on GitHub on October 22. It also says an independent tracker listed more than 30 projects and packages with bundled copies, and that on October 26 it still showed seven copies as unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. These are tracker findings reported by the source, not a complete inventory of every deployment.
Separate incidents should not be conflated with this vulnerability. The source mentions DreamHost resetting some email and FTP/SFTP passwords after an incident, but says the company named no cause and that nothing links that incident to Brotli.
““a bigger deal than PHP2Shell””
— Juliano Rizzo, security researcher, as quoted by Thorsten Meyer
Exposure Varies by Bundled Copy
The source reports no confirmed in-the-wild exploitation as of October 26, 2026. That status could change, and the absence of a listing in CISA’s Known Exploited Vulnerabilities catalog does not prove that no attack has occurred. The article does not provide a full list of affected deployments or evidence that every product using Brotli is exposed through an attacker-accessible input.
Some products bundle their own decoder, while others use an operating system’s library; this can change which update applies. The source identifies several bundled copies that its tracker still marked unfixed, but does not establish their release schedules or the status of every downstream package. It is also not clear from the material how many systems have been patched and restarted, or whether the reported code-execution demonstration applies to configurations beyond those tested.
Check, Patch and Restart
System owners should inventory Brotli use across runtimes, applications, proxies, file-processing tools, containers and operating-system packages. They should then follow the relevant vendor advisory, update to a listed fixed version where available, and restart affected processes so they load the patched decoder. Where a bundled copy has no release yet, operators should monitor the project’s security notices and consider limiting untrusted compressed input in line with their own risk controls.
The next practical milestone is the release of fixes for remaining bundled copies and their arrival in downstream distributions and container images. The source does not give a timetable for those releases. Organizations should verify versions after deployment and continue checking advisories, since a top-level dependency update may not replace a separately bundled library.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli decoder. The source says malformed compressed input can cause an out-of-bounds write and may lead to memory corruption.
Which versions are affected?
The source identifies Brotli 1.0.3 through 1.2.0 as affected. Products may bundle their own copy, so check the specific runtime or vendor advisory rather than relying only on a system-wide library version.
Does upgrading Node.js fix every installation?
No single Node.js update covers every deployment. The source lists fixes for Node.js 22.23.4, 24.22.1 and 26.12.1, but says versions 20, 23 and 25 receive no fix. Some distributions may use a system Brotli library, so confirm which build and support channel applies.
Is the flaw being exploited in the wild?
The source reports no confirmed exploitation in the wild as of October 26, 2026. It describes a researcher demonstration of code execution on an unmodified Node.js image; that is not the same as evidence of active attacks.
Why must affected services be restarted?
A running process can continue using the decoder loaded before the update. Restarting it after patching lets it load the fixed library or runtime; verify the deployed version and the status of any bundled copy as well.
Source: ThorstenMeyerAI.com
