🔍 Read the full analysis: Is Your Broccoli2Shell Fix Complete? Review Patches, Restarts, And Checks on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Broccoli2Shell, tracked as CVE-2026-111497, is a memory-corruption flaw in Google’s Brotli decoder that affects multiple runtimes and software packages. Fixes are available for several major components, but organizations must update the affected dependency and restart running processes; the source material reports seven bundled copies still unfixed as of October 26, 2026.
Fixes for Broccoli2Shell, a critical flaw in Google’s Brotli decoder tracked as CVE-2026-111497, are now available for several widely used runtimes and packages, but applying a patch may not complete remediation: operators also need to restart processes using the vulnerable decoder. The issue can cause memory corruption when software handles crafted compressed data, and the source material says seven bundled copies remained unfixed as of October 26, 2026.
The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js advisory, malformed input can be treated as data that is still arriving, rather than as invalid, causing the decoder to write beyond an internal buffer. The consequences can include a crash or memory exposure; code execution is a possible worst-case outcome, not a confirmed result for every affected system.
Available fixed releases listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Fixes are also listed for Envoy, Istio, .NET and Debian packages. These version numbers are specific to each project; administrators should follow the advisory for the actual component and release they use.
Updating files alone may leave a service exposed. A running process can continue using its already loaded decoder, so the source advises restarting after patching. Checks should cover direct dependencies and software that bundles Brotli, including containers and system packages. Official Node.js builds include their own Brotli copy, while some Linux distributions use a system library, so the correct update path can vary.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli Reaches Many Stacks
Brotli is used to compress web traffic and is also included in tools that process files. That makes this more than a single-runtime patch: the same underlying decoder can reach applications through HTTP responses, accepted request bodies and file-processing features. The source identifies Node.js fetch and several Python HTTP clients as examples of software that can decode Brotli responses, while some Express and body-parser versions can inflate Brotli request bodies when configured to do so.
The practical risk depends on whether a system actually processes attacker-controlled compressed input and how its dependencies are packaged. Still, the number of downstream copies complicates response. Teams may need to patch an application package, runtime, operating-system package or container image—and verify that deployed processes have restarted. The source reports that a public proof of concept appeared on October 22, but says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the report. That is not proof that exploitation is impossible or that every environment is safe.
Products Worth Considering
Jackery Explorer 300 Portable Power Station, 292Wh
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
As an affiliate, we earn on qualifying purchases.
From Brotli Commit to Runtime Fixes
The source says the underlying change entered Brotli’s code on February 27, 2026, under a commit titled “Detect and report invalid stream earlier.” It reports that releases containing the fix arrived October 21, a gap of 236 days. The commit did not identify the change as a security fix, according to the source, and OpenAI said the vulnerability was not known at the time and that Brotli had no later release.
The CVE became public on October 22, followed by a public proof of concept that day, according to the source’s cited tracker. Security advisories and package fixes then spread across projects. As of October 26, that tracker listed seven bundled copies as still unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; it also said five other projects had fixes in their main branches. Those tracker counts reflect the date of the source report and may change.
Unfixed Copies and Exposure Questions
The source’s October 26 count of seven unfixed bundled copies is a dated snapshot, not a complete or live inventory. It does not establish whether every product named is reachable by untrusted input, whether all affected deployments have updated, or how many systems remain vulnerable. Bundlers and maintainers may release changes after the report.
Exploitability also varies by how a decoder is used. The source says Imperva demonstrated code execution on an unmodified official Node.js image after several attempts, while CISA data listed no exploitation. These statements are not contradictory: a demonstration establishes a reported test result, while the CISA status concerns known exploitation in the wild. Public exploitation status can change, and the provided material does not establish that attackers are currently using the flaw.
Patch, Restart, Then Verify
Organizations should identify Brotli versions across application dependencies, runtimes, operating-system packages, container images and embedded copies, then apply the fixed release for each affected component. After deployment, restart services and workers that may retain the old decoder in memory. A package update without a restart may not replace code already loaded by a running process.
Teams should also monitor vendor advisories and the status of bundled copies that had no fix listed in the October 26 report. Confirm the deployed version in the environment that handles real traffic or files, not only in a development lockfile. The available source does not give a universal verification command or say when all downstream projects will publish fixes; the next milestones are project-specific releases and updated security advisories.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. The reported bug can cause an out-of-bounds write when malformed compressed input is processed.
Does installing the patch finish the fix?
Not necessarily. The source says to restart affected processes after updating because a running service may still have the old decoder loaded. Verify the version in the deployed environment as well as updating the package.
Which Node.js versions have fixes?
The source lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. It says Node.js 20, 23 and 25 do not receive a fix, so users on those lines should consult Node.js guidance for supported options.
Is Broccoli2Shell being exploited in the wild?
The source says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also reports a public proof of concept and a code-execution demonstration on an unmodified Node.js image; neither alone establishes widespread in-the-wild exploitation.
Could my application be affected if I do not use Brotli directly?
Yes. A runtime, HTTP client, proxy, package or tool may include Brotli indirectly or bundle its own copy. Check the dependencies and deployment components that process compressed responses, request bodies or files.
Source: ThorstenMeyerAI.com
