🔍 Read the full analysis: How Teams Can Coordinate A Broccoli2Shell Patch Across Services on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE-2026-111497 affects Google’s Brotli decoder and has been carried into runtimes, packages and other software that use or bundle it. Fixes are available for several major platforms, but teams need to check each dependency and restart running processes; the source tracker still listed some bundled copies as unfixed on October 26, 2026.
Security fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are now available across several runtimes and software packages, but teams must check every service and bundled copy that uses the library. The flaw can be triggered by crafted compressed data; a code-execution demonstration was reported on an unmodified Node.js build, while CISA’s data listed no known exploitation as of the source report’s October 26 update.
The vulnerability affects Google’s Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js advisory, malformed input can be treated as incomplete rather than invalid, causing the decoder to write past an internal eight-byte buffer. The resulting memory corruption can crash a process or, in the worst case, permit code execution. The CVE record identifies an out-of-bounds write and an unchecked return value.
Published fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updated releases of Envoy, Istio and .NET. Debian also lists fixed package versions. These are version-specific release details reported October 26 and should be checked against each project’s current advisories before deployment.
Updating a package is not the full response: running processes retain the decoder loaded at startup, so affected services need a restart after patching. Node.js 20, 23 and 25 were listed as receiving no fix. Teams should not assume that updating a high-level framework resolves the problem: the flaw is in Brotli, not Express, and software can use either a system library or a copy bundled inside its own release.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Fixes Must Cross Service Boundaries
The practical challenge is the number of routes by which compressed data reaches a decoder. Node.js’s built-in fetch can decode Brotli responses automatically. Python clients may do the same when a Brotli package is installed. Webhooks, link previews, crawlers and URL-import features can therefore involve the vulnerable code even when application teams did not call the decoder directly.
Other exposure paths include accepting compressed request bodies and processing files. The source report says Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 can inflate Brotli request bodies in certain parsers, but upgrading Express alone does not replace the vulnerable decoder. Archives, fonts, Parquet data and firmware tools may also rely on Brotli. A single service inventory is unlikely to cover every copy across dependencies, containers and infrastructure.
This makes remediation a cross-team release task: application owners, platform teams and maintainers of shared images may each control a different layer. An independent tracker cited in the source listed more than 30 affected projects or packages and, as of October 26, seven bundled copies still unfixed. That status can change as maintainers publish releases.
Products Worth Considering
Apple iPad Air (4th Generation, 10.9-inch, Wi-Fi, 256GB) – Space Gray
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
From Brotli Commit to Public Advisory
The source report says the underlying code change was committed to Brotli on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says the commit did not identify the change as security-related. OpenAI said the vulnerability was not known at the time and that Brotli had no more recent release. The fixed releases appeared on October 21, a gap of 236 days between the source change and releases carrying the fix.
The CVE became public on October 22, and a public proof of concept appeared the same day, according to the cited tracker. The report says Imperva demonstrated code execution on an official Node.js image after several attempts. That is a reported demonstration, not evidence that attackers are exploiting the flaw in the wild. The CVE record assigns a 9.2 Critical score under CVSS 4.0; the source says CISA’s data showed “exploitation: none” and the vulnerability was not in its Known Exploited Vulnerabilities catalog.
Some Node.js builds include their own Brotli copy, while some Linux distributions link Node.js to a system library, so the relevant fix depends on how a service was built. The source also reports that Python package advisories were absent from some advisory databases on October 23 before GitHub added them later that day. This history illustrates why a scanner’s silence does not establish that a dependency is unaffected.
““A bigger deal than PHP2Shell””
— Juliano Rizzo, as quoted by broccoli2shell.com
Remaining Gaps in Component Coverage
The source report’s October 26 tracker still listed seven bundled copies as unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. It also said five other projects had fixes in their main branches. A main-branch change may not yet be available in a stable release, and tracker entries can become outdated; teams need to confirm the status with each maintainer.
The extent of real-world exposure is also not established by the reported demonstration. The cited CISA data showed no exploitation, but that does not prove that no attempts have occurred. The source does not provide a complete list of affected deployments, the number of vulnerable services, or evidence that every listed integration is reachable with attacker-controlled data.
It remains necessary to determine which systems use a bundled decoder, which link against an operating-system library, and whether a given service actually processes untrusted Brotli data. The reported fixes and version ranges are not a substitute for checking current vendor advisories and build configurations.
Patch, Rebuild and Restart Services
Teams should first inventory Brotli use across direct dependencies, transitive packages, runtime builds, operating-system packages, containers and file-processing tools. They should then match each component to its vendor’s fixed release, update the dependency or base image, and restart or redeploy affected processes so the patched decoder is loaded. Where a stable fix is not yet available, teams should follow the maintainer’s advisory and assess whether the component can be isolated or temporarily removed from exposed workflows.
After deployment, owners should verify the running versions rather than relying only on a successful build or a dependency scan. Teams should also recheck advisories for components that had no fix at the October 26 reporting cutoff. The next milestone is the release of remaining bundled-copy updates and confirmation that affected services have moved onto patched builds.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for the security issue involving CVE-2026-111497, a flaw in Google’s Brotli C decoder. The source report says malformed compressed input can cause an out-of-bounds write and memory corruption.
Does updating Express fix the vulnerability?
Not by itself. The reported flaw is in Brotli, not Express. If a service uses Brotli to decompress request bodies, its Brotli dependency or bundled decoder must be updated as well.
Which Node.js versions have fixes?
The source lists fixes in Node.js 22.23.4, 24.22.1 and 26.12.1. It says Node.js 20, 23 and 25 have no fix. Check the current Node.js security advisory for later release information.
Is the flaw being exploited in the wild?
The source report says CISA’s data listed “exploitation: none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. Imperva’s reported code-execution demonstration is not evidence of in-the-wild exploitation.
Why must services restart after patching?
A running process can keep using the decoder it loaded at startup. Restarting or redeploying the service after installing the fixed version is needed for the process to use the updated code.
Source: ThorstenMeyerAI.com
