🔍 Read the full analysis: Broccoli2Shell: A Compression Bug Affecting Node.js, Python, And Beyond on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A memory-corruption flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has reached software that bundles or uses the library. Fixes are available for several runtimes and packages; the source says there is no known in-the-wild exploitation, but some bundled copies remain unpatched.
CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, has prompted security updates across Node.js, Python packages and other software that uses or bundles the library. The flaw affects Brotli versions 1.0.3 through 1.2.0; fixes are available for several products, but some bundled copies remain unpatched, according to the October 26 report from ThorstenMeyerAI.com.
The flaw occurs when the decoder handles a malformed compressed stream as though it is incomplete and waiting for more input. The Node.js advisory says that behavior can lead to an out-of-bounds write in an internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on the circumstances, memory corruption can crash a process, expose data or potentially allow code execution.
The report says Imperva demonstrated code execution on an official Node.js image after several attempts. That is a research demonstration, not evidence that attackers have exploited the flaw in real-world attacks. The source reports that Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0, while CISA’s data lists exploitation as “none”; the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26.
Fixes listed in the report include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. Node.js 20, 23 and 25 are listed as receiving no fix. Administrators must restart affected services after updating: a running process can continue using the old decoder.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli’s Reach Matters
Brotli is used to compress web traffic and is incorporated into a broad range of applications. That means exposure does not stop at one language or product: it can affect runtimes, proxy software, packages, container images and tools that bundle their own copy. The report names potential exposure through automatically decoded responses, compressed request bodies handled by some parsers, and files processed by software using the C decoder.
This makes inventory and patching more complicated than updating one shared library. Official Node.js builds include their own Brotli copy, so the report says users need an appropriate Node.js release; some Linux distributions instead link Node.js to a system library. The report also says that, as of October 26, an independent tracker listed more than 30 projects and packages bundling Brotli, with seven copies still unfixed. A patch to an upstream library does not automatically update every product that incorporated it.
Python package downloads illustrate the possible scale of use, but not the number of vulnerable installations: the source cites about 83 million downloads of Python’s Brotli package in the previous month, based on pypistats.org checked October 26. That count does not establish how many downloads were active systems, exposed applications or successful attacks.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Brotli Fix to Broad Disclosure
The report dates the underlying source-code change to February 27, 2026. The change was titled “Detect and report invalid stream earlier,” and the source says it did not identify a security issue. OpenAI said the vulnerability was not known at the time and that Brotli had not had a more recent release. The fix-bearing releases arrived on October 21, according to the report: a gap of 236 days between the code change and those releases.
The CVE became public on October 22, and the report says a public proof of concept appeared on GitHub the same day. Since disclosure, fixes have had to move through projects that package their own copies and through downstream distributions. The report says Python package advisories were absent from an advisory database on October 23 before GitHub’s advisory was added later that day. It lists DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools among copies still awaiting fixes on October 26, while noting that other projects had fixes in their main branches.
Node.js credits OpenAI Codex Security in its advisory. OpenAI said it found the issue during red-teaming with teams of AI agents. These are attributions about how the flaw was found; they do not change the need to verify whether a particular product has received and deployed a fix.
“The decoder treated one kind of malformed input as “waiting for more data” instead of “this is broken.””
— Node.js advisory, as described by ThorstenMeyerAI.com
Exposure and Exploitation Still Unclear
The report says there is no confirmed exploitation in the wild as of October 26, but that status does not rule out undiscovered activity. It also remains unclear how many deployed systems use vulnerable copies, whether specific applications expose the decoder to attacker-controlled input, and how quickly downstream products will ship updates. A project may also have fixed its main development branch without releasing a patched version to users.
The listed CVSS score and Imperva’s code-execution demonstration describe severity and technical possibility, not proof that every affected deployment can be exploited in the same way. The report does not provide a complete product-by-product inventory or evidence that every installation of a named package is vulnerable in its particular configuration. Its separate mention of DreamHost password resets says the company named no cause and that there is no reported link to Brotli.
Patch Releases and Restarts
Organizations should check the exact runtime, package, distribution and bundled components used in their systems against vendor advisories, then apply a patched release where available. For Node.js, the report lists versions 22.23.4, 24.22.1 and 26.12.1; it says versions 20, 23 and 25 have no fix. Teams relying on a system Brotli library should check their distribution’s update rather than assuming the bundled-runtime version applies.
After updating, operators need to restart affected processes so they no longer run the old decoder, and rebuild or redeploy images where vulnerable libraries are embedded. They should keep checking advisories for products whose bundled copies were still listed as unfixed on October 26. The next key developments are additional downstream releases and any updated reporting on exploitation; neither is confirmed in the source material.
Key Questions
What is Broccoli2Shell?
It is the name used for CVE-2026-111497, a flaw in Google’s Brotli decoder. Malformed compressed input can trigger an out-of-bounds write, creating a risk of memory corruption.
Which software is affected?
The source identifies Brotli versions 1.0.3 through 1.2.0 and products that use or bundle them, including Node.js, Python Brotli packages, Bun, Envoy, Istio, .NET and some Linux distribution packages. Check each product’s advisory because bundled copies may have separate release schedules.
Are attackers exploiting the flaw?
The report says CISA’s data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. Imperva demonstrated code execution in testing, but that is not evidence of exploitation in the wild.
Is upgrading enough to protect a running service?
Not necessarily. The report warns that an already-running process can retain the old decoder after a package update. Apply the relevant fix and restart affected processes; rebuild or redeploy images if they contain a vulnerable copy.
What if my Node.js version is 20, 23 or 25?
The source lists those Node.js versions as receiving no fix. Check the current Node.js security guidance and your deployment’s support options; do not assume a patch exists for those release lines.
Source: ThorstenMeyerAI.com
