🔍 Read the full analysis: Broccoli2Shell Across Ecosystems: A Patch And Recovery Checklist on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and products that include them. Fixed releases are available for several runtimes and packages, but some bundled copies remain unpatched; affected services need both an update and a restart.
Security fixes for Broccoli2Shell, a memory-corruption flaw in Google’s Brotli decoder tracked as CVE-2026-111497, now cover several language runtimes, packages and infrastructure projects. The issue affects Brotli versions 1.0.3 through 1.2.0; operators need to install a fixed release and restart running processes, while some products that bundle their own copy remain without a released fix.
The flaw occurs when the decoder handles a malformed compressed stream as though it is incomplete and waiting for more input. According to the Node.js security advisory, that behavior can lead to a write beyond an eight-byte internal buffer. The resulting memory corruption could crash a process or expose memory; code execution is a possible worst-case outcome, not a confirmed result in every affected deployment. Google’s CVE record lists an out-of-bounds write and an unchecked return value.
Fixed versions listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updated releases of Envoy, Istio and .NET. Debian also lists fixed package versions. These are the versions provided in the source material as of October 26; administrators should check the advisory for their exact product and distribution.
Updating alone may not be enough. A process already running can continue using its old decoder until restarted, according to the source. Official Node.js builds include their own Brotli copy, so their security version is tied to the Node.js release. In other installations, Node.js may use a system library instead. Updating Express alone does not fix the decoder flaw in affected configurations because the vulnerable code is in Brotli, not Express.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why One Decoder Affects Many Stacks
Brotli is used to compress and decompress web traffic and other data, and the same C decoder is included in products across languages and infrastructure. That means the exposure is not limited to applications developers who knowingly added Brotli: it can arrive through runtime builds, Python packages, proxies, distributions and bundled dependencies. The source identifies possible exposure paths including automatically decoded web responses, Brotli-compressed request bodies, and tools that process files such as archives or data formats.
The practical consequence is a supply-chain response rather than a single package upgrade. Teams must identify whether their deployed product contains an affected copy, locate the vendor’s fixed release, update images or packages, and restart services. The source says an independent tracker listed more than 30 projects and packages that bundle their own copy, with seven still lacking a fix as of October 26. That count is a tracker snapshot, not a complete inventory of every affected product.
The available evidence also calls for proportionate urgency. The CVE record gives the issue a 9.2 Critical score under CVSS 4.0, and security firm Imperva reported running code on an official Node.js image after several attempts. That demonstration shows a possible impact under particular conditions; it does not establish that all vulnerable systems are remotely exploitable. The source reports no known exploitation in the wild as of October 26.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
From February Fix to October Releases
The source reports that the underlying code change was committed to the Brotli project on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says the commit did not identify the change as security-related. OpenAI later said the security significance was not known at the time and that no newer Brotli release was available. The fixed releases appeared on October 21, creating a reported 236-day gap between the source change and releases containing it.
The issue became public on October 22, according to the source, and a public proof of concept appeared the same day. The source also says some Python packages were missing from advisory databases on October 23 before a GitHub advisory was added later that day. Those details help explain why dependency scanners or downstream projects may not have flagged every affected copy promptly.
Node.js, Python’s Brotli and brotlicffi packages, Bun, Envoy, Istio, .NET and Linux distributions are among the products named in the supplied material. It says Node.js 20, 23 and 25 do not have fixes listed. Security researcher Juliano Rizzo described the issue as “a bigger deal than PHP2Shell” and compared it to “zlib 20 years ago,” according to the source. That is his assessment, not a formal severity finding.
Which Bundled Copies Remain Exposed
The full set of affected deployments is not established in the supplied material. As of October 26, its tracker listed seven bundled copies without released fixes, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools; it said five more had fixes in their main branches. A fix in a development branch does not necessarily mean a packaged release is available, so users need to confirm the status with each project or vendor.
The source reports that CISA’s data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time. That is a status snapshot, not proof that exploitation cannot occur or that no unreported activity exists. The exact conditions required for code execution, the number of vulnerable systems exposed to untrusted input, and whether attacks have occurred remain unclear from the supplied material.
There is also no stated link between this vulnerability and DreamHost’s separate password resets for some email and FTP/SFTP accounts. The source says DreamHost named no cause. The two developments should not be treated as connected.
Patch, Restart and Verify
Administrators should inventory deployed runtimes and dependencies, including copies bundled by applications and system packages, then compare their versions with the vendor’s security advisory. Apply the fixed release appropriate to the product, rebuild affected containers or images, and restart processes so they load the patched decoder. Where a vendor has not released a fix, monitor its advisory and consider whether the affected feature can be limited while awaiting an update.
Teams should also check how their software handles compressed data: responses fetched from other services, request bodies accepted from users, and files processed by internal tools can all involve Brotli decoding. The supplied source notes that a bare Node.js HTTP server does not decode request bodies automatically, while some frameworks and HTTP clients do so when configured with Brotli support. Exposure therefore depends on the specific application and dependency path.
Next, downstream projects and distributions are expected to continue publishing updates, and security trackers may change as more bundled copies are identified. The source provides no fixed date for those releases. Operators should confirm their installed package and runtime versions against current vendor notices rather than assume that a general application update has covered every copy.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder. The source says malformed compressed input can trigger a write beyond an internal buffer; code execution was demonstrated in one Node.js setup.
Which versions are affected?
The supplied material identifies Brotli 1.0.3 through 1.2.0 as affected. Downstream products may bundle their own decoder, so check the version and advisory for each runtime, package or distribution rather than relying only on an application’s direct dependencies.
Is there a fix for Node.js?
The listed fixed releases are Node.js 22.23.4, 24.22.1 and 26.12.1. The source says Node.js 20, 23 and 25 have no fix listed. Check the current Node.js advisory for later updates or guidance for unsupported versions.
Does installing the patch take effect immediately?
No. The source says a running process can keep using its old decoder until it is restarted. Update the relevant package or runtime, redeploy affected images where needed, and verify that services are running the fixed version.
Is Broccoli2Shell being exploited in the wild?
The supplied material reports no known exploitation in the wild as of October 26, 2026. It also cites a code-execution demonstration by Imperva under specific conditions. The absence of reported exploitation does not remove the need to patch vulnerable systems.
Source: ThorstenMeyerAI.com
