🔍 Read the full analysis: Broccoli2Shell Response Guide: Patch, Restart, And Check Your Services on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
CVE-2026-111497 affects Google’s Brotli C decoder in versions 1.0.3 through 1.2.0, and can cause memory corruption when processing malformed compressed data. Fixes are available for several runtimes and packages, but operators must update the affected component and restart running services; some bundled copies remained unpatched as of October 26, 2026. There is no confirmed evidence of exploitation in the wild in the cited sources.
Maintainers have released fixes for CVE-2026-111497, a flaw in Google’s Brotli compression decoder that can corrupt memory when it processes specially malformed data. The issue affects Brotli versions 1.0.3 through 1.2.0 and has spread across runtimes and applications that bundle or use the library, prompting a practical response for operators: update the affected component and restart processes so they load the fixed decoder.
The fix stops the decoder from treating certain invalid input as if it were incomplete data. According to the Node.js security advisory, that behavior could cause writes past an eight-byte internal buffer. The resulting memory corruption can crash a process or, in more severe circumstances, expose data or permit code execution. Google’s CVE record lists an out-of-bounds write and an unchecked return value. The available sources do not establish that every affected deployment is remotely exploitable.
Fixed releases listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. The source says Node.js versions 20, 23 and 25 will not receive a fix. Operators should check the vendor advisory for their exact platform and supported release.
Updating files alone may not change the decoder already loaded by a service. A running process can retain the vulnerable library until it is restarted. The report says official Node.js builds include their own Brotli copy, while some Linux distributions link Node.js to a system library, so the right update depends on how the runtime was packaged. Upgrading Express by itself is not a remedy where the underlying Brotli dependency remains vulnerable.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why the Decoder Reaches Many Services
Brotli is used to compress web traffic and other data, so a flaw in its decoder can affect more than one application or programming language. The source identifies possible exposure through automatically decoded web responses, services that accept compressed request bodies, and tools that process files such as archives or data formats. Node.js fetch, Python HTTP clients with Brotli support, and middleware that inflates compressed request bodies are among the examples described.
The breadth of use makes dependency checks and restarts relevant even for teams that did not directly choose Brotli. A runtime, package, container or operating-system build may include its own copy. The source’s tracker listed more than 30 projects and packages that bundle Brotli and said seven bundled copies were still unfixed as of October 26. That count is a tracker snapshot, not a complete inventory of every deployment or a measure of active attacks.
The current evidence calls for prompt maintenance, not assumptions that systems have already been compromised. The CVE record gives the issue a 9.2 Critical score under CVSS 4.0. The source also reports that Imperva demonstrated code execution on an unmodified official Node.js image after several attempts, while CISA data recorded no exploitation and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time covered.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
As an affiliate, we earn on qualifying purchases.
From Source Fix to Runtime Patches
The underlying Brotli change was committed on February 27, 2026, according to the source. Its GitHub title was “Detect and report invalid stream earlier”; the report says the commit did not identify the change as security-related. Releases carrying the fix appeared on October 21, a 236-day interval. The CVE became public the following day, when a public proof of concept also appeared, according to the cited tracker.
Once a common library fix is released, it must pass through dependent projects and distributions before reaching deployed services. The source describes updates across the Brotli library, language runtimes, packages, Linux distributions and bundled copies. It also says Python packages were absent from advisory databases on October 23 before a GitHub advisory was added later that day, illustrating why a dependency scanner may not immediately flag every affected package.
The reporting credits OpenAI Codex Security in the Node.js release notes. OpenAI said it found the flaw during red-teaming with teams of AI agents. Those details describe how the issue was identified; they do not change the patch requirements or establish that AI tools found every vulnerable copy.
“The decoder treated malformed input as “waiting for more data” instead of “this is broken.””
— Node.js security advisory, as summarized by ThorstenMeyerAI.com
Exposure and Remaining Vulnerable Copies
The sources do not report confirmed exploitation in the wild. CISA data was listed as “exploitation: none”, and the CVE was not in its Known Exploited Vulnerabilities catalog at the time of the report. That status does not prove that exploitation is impossible or that every environment is safe; it describes the available tracking information.
It is not yet clear from the supplied material how many deployed systems remain vulnerable, which have processed attacker-controlled Brotli data, or whether any have been compromised. The tracker listed seven unfixed bundled copies on October 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. The status of those projects may change, and the cited report does not provide fixes for all of them.
The source also does not give a universal patch instruction for each operating system, container image or vendor-supported runtime. Teams need to verify their dependency path and release status rather than infer safety from the version of a top-level application alone.
Verify Updates and Restart Processes
Administrators should identify where Brotli is used, check the relevant runtime or package advisory, and apply a fixed release that is supported for their environment. That includes reviewing bundled dependencies and system libraries, not only direct package declarations. Where no fixed release is listed, teams should monitor the project’s security notices and follow vendor guidance rather than assume an unrelated application update resolves the decoder issue.
After updating, restart affected services and workloads so they load the new library. Then verify the running version and deployment image, including instances that may not have been replaced during a routine rollout. The available sources do not provide a single cross-platform verification command, so checks should follow each project’s own instructions.
Further updates are likely as maintainers publish fixes for bundled copies and operating-system packages. The immediate status to watch is whether the remaining projects identified by the tracker release patches, and whether security agencies or vendors report evidence of exploitation.
Key Questions
What is Broccoli2Shell?
It is the name used for the vulnerability CVE-2026-111497 in Google’s Brotli C decoder. The reported flaw can cause memory corruption when the decoder processes certain malformed compressed input.
Which versions are affected?
The source identifies Brotli decoder versions 1.0.3 through 1.2.0 as affected. The specific release to install depends on the runtime, package or operating system using the decoder.
Is updating enough, or do services need to restart?
Services need to restart after the update so their running processes load the fixed decoder. A process may keep using the old library until it is restarted.
Has the vulnerability been exploited in the wild?
The supplied report says CISA data listed exploitation as none and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It does report a controlled code-execution demonstration by Imperva, which is not the same as confirmed real-world exploitation.
Does upgrading Express fix the problem?
Not by itself, according to the source. The flaw is in Brotli’s decoder, so teams must update the affected Brotli dependency or runtime; an Express update alone may leave that decoder unchanged.
Source: ThorstenMeyerAI.com
