🔍 Read the full analysis: Broccoli2Shell: Steps To Address A Compression Bug In Node.js And Python on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, can corrupt memory when it processes crafted compressed data. Fixes are available for Node.js, Python packages and several other platforms; operators must update and restart affected processes. The source reports no confirmed in-the-wild exploitation as of October 26, 2026.
Fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are now available for Node.js, Python’s Brotli packages and several other software platforms. The vulnerability can be triggered by crafted compressed data, and affected services need both an update and a restart to use the patched decoder, according to the October 26 report from ThorstenMeyerAI.com.
The flaw affects Brotli C library versions 1.0.3 through 1.2.0. The Node.js advisory says the decoder could treat malformed input as if it were incomplete, then write beyond an internal eight-byte buffer. The resulting memory corruption could crash a process or expose memory; code execution is a possible worst-case outcome. Google’s CVE record lists an out-of-bounds write and an unchecked return value.
Published fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The source also lists fixes for Bun, Envoy, Istio, .NET and Debian releases. Node.js 20, 23 and 25 are listed as receiving no fix. Operators should check the advisories for their exact platform and supported release.
Updating a package alone may not remove the vulnerable code from a running service: processes need to restart to load the updated decoder. Exposure depends on how an application handles Brotli data. Examples include automatically decoded web responses, accepted compressed request bodies and tools that open Brotli-based files. The report says a bare Node.js HTTP server does not decode request bodies by itself, and the flaw is in Brotli rather than in Express.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli Patches Cross Stacks
The issue matters because Brotli is embedded in a wide range of software, so a single decoder defect can affect applications that do not directly depend on the C library. The report identifies Node.js, Python packages, Bun, Envoy, Istio and .NET among affected platforms, as well as projects that bundle their own copy. That makes a single system-wide upgrade insufficient in some environments: teams may need to check language dependencies, runtime versions, operating-system packages, container images and standalone tools.
Compressed data can arrive through routine application features, including fetching web content, processing webhooks or importing files. That does not mean every service is exposed: the risk depends on whether a vulnerable decoder processes attacker-controlled input. The report says Imperva demonstrated code execution on an official Node.js image after several attempts, while Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0. Those details indicate serious potential impact, but do not establish widespread exploitation.
The source reports that CISA’s data showed “exploitation: none” and that the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog as of October 26. That is a time-specific status, not a guarantee that the flaw will remain unexploited. The practical priority is to identify affected components, apply the relevant fix, restart services and monitor for updated advisories.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Fix Took 236 Days to Ship
The source says the Brotli code change was committed on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says the commit did not identify a security issue. Releases containing the fix appeared on October 21, a gap of 236 days. OpenAI said on X that the security significance was not known at the time and that no newer Brotli release had been available.
The vulnerability became public on October 22, according to the report, and a public proof of concept appeared the same day. The fix then had to move through projects that bundle the decoder, their own release processes, operating-system packages and deployed applications. The report says that on October 23, Python packages were missing from advisory databases before GitHub’s advisory entry was added later that day, a delay that could leave dependency scanners without an alert.
As of October 26, the independent tracker cited by the source listed more than 30 projects and packages using bundled copies, with seven still unfixed and five more fixed in their main branches. The source names DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools among the copies still awaiting fixes. These tracker figures are a snapshot and may change as maintainers publish releases.
““A bigger deal than PHP2Shell.””
— Juliano Rizzo, security researcher, as quoted by ThorstenMeyerAI.com
Exposure and Exploitation Status
No confirmed in-the-wild exploitation is reported in the supplied source as of October 26, 2026. It cites CISA data showing “exploitation: none” and says the CVE was not in the agency’s Known Exploited Vulnerabilities catalog. That status could change, and absence from the catalog does not show that every affected service is safe.
The full set of affected products and the patch status of every bundled copy remain subject to change. The source’s tracker lists some projects as still unfixed and others with fixes only in their main branches; it does not establish that stable releases are available for each. Whether a particular system can be attacked also depends on whether it processes crafted Brotli data through a vulnerable version. The supplied material does not report confirmed cases of exploitation or provide a complete inventory of exposed deployments.
Check Releases and Restart Services
Teams should inventory Brotli use across runtimes, packages, operating-system libraries, bundled dependencies and container images, then apply the patch published for each supported component. For Node.js, the report lists fixes in 22.23.4, 24.22.1 and 26.12.1; for Python, it lists Brotli 1.2.1 and brotlicffi 1.2.1.0. Administrators should check current vendor advisories because release availability can change after the source’s October 26 snapshot.
After updating, operators should restart affected processes and redeploy patched images; otherwise an already-running service may keep using the old decoder. Teams should also check projects with bundled copies rather than assuming a system library update covers them. Maintainers are expected to publish or confirm fixes for remaining affected copies, but the supplied source does not give release dates for those projects. Security advisories and tracker updates will clarify which components remain vulnerable.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used in the source report for CVE-2026-111497, a flaw in Google’s Brotli decoder. Crafted compressed input can cause an out-of-bounds write and memory corruption.
Which Node.js and Python versions are listed as fixed?
The report lists Node.js 22.23.4, 24.22.1 and 26.12.1, plus Python Brotli 1.2.1 and brotlicffi 1.2.1.0. It says Node.js 20, 23 and 25 receive no fix; users should consult current advisories for supported upgrade paths.
Does installing a patch protect a running service immediately?
No. The source says a running process retains its existing decoder until it restarts. Update and restart affected services, and redeploy any patched container images.
Is the vulnerability being exploited in the wild?
The supplied report says no exploitation was recorded in CISA’s data as of October 26, 2026, and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog. That is a dated status and does not rule out later developments.
Does upgrading Express fix the issue?
Not by itself, according to the source. The flaw is in the Brotli decoder, not Express. Applications that inflate Brotli request bodies need the affected Brotli component patched; a bare Node.js HTTP server does not decode request bodies automatically.
Source: ThorstenMeyerAI.com
