🔍 Read the full analysis: Broccoli2Shell In Your Stack: How To Find And Fix Compression Exposure on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE-2026-111497 is a critical flaw in Google’s Brotli C decoder that can cause memory corruption when it processes crafted compressed data. Fixes are available for several runtimes and packages, but some bundled copies remain unpatched; affected services need both an upgrade and a restart.
Security updates are spreading for CVE-2026-111497, a critical flaw in Google’s Brotli C decoder that can corrupt memory when it processes specially crafted compressed data. The issue affects multiple runtimes and applications that use Brotli, and defenders must update vulnerable components and restart running processes to load the fixes.
The vulnerability affects Brotli decoder versions 1.0.3 through 1.2.0, according to the source material’s summary of advisories and tracker data. A malformed stream can be treated as incomplete input rather than rejected. The decoder may then write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Possible effects include a crash or memory exposure; code execution is a potential worst-case impact, not an established outcome in every affected deployment.
Fixes listed as of October 26, 2026 include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The source also lists fixed releases for Bun, Envoy, Istio, .NET and Debian. These version numbers are component-specific: teams should check the advisory for the exact software and release channel they run.
Updating a package does not necessarily change a decoder already loaded in a live process. The source advises restarting affected services after patching. It also says Node.js 20, 23 and 25 have no listed fix, and that some projects that bundle their own Brotli copy remained unfixed on October 26. A system’s actual exposure depends on its runtime, build method and use of Brotli decoding.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Stacks
Brotli is used to compress web traffic and other data, so a defect in its decoder can spread through software that depends on it. The affected components listed in the source range from Node.js and Python packages to proxies, service-mesh software, .NET and tools that handle files. A team may therefore need to check more than its direct application dependencies: a runtime or third-party tool can include its own copy.
Exposure depends on whether a vulnerable decoder processes attacker-controlled compressed input. The source identifies several possible routes: responses fetched by applications, compressed request bodies accepted by parsers, and files processed by tools using the C library. In Node.js, built-in fetch can decode Brotli responses; the source says a bare Node.js HTTP server does not automatically decode request bodies. This distinction matters: the presence of a vulnerable version is a reason to patch, but does not by itself establish that a particular service is remotely exploitable.
The patch chain adds practical risk. Fixes must reach libraries, runtimes, package releases, distributions and deployed images, then be loaded by restarted processes. The source reports that one fix was present in Brotli’s source for 236 days before releases carrying it appeared. That interval illustrates how a correction in a shared dependency can take time to reach downstream users.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Downstream Software
The root-cause change was committed to Brotli’s source code on February 27, 2026, under a title describing earlier detection of invalid streams. The source says the commit did not identify the change as security-related. Releases containing the fix appeared on October 21. The CVE became public on October 22, when a proof of concept also appeared, according to the cited project tracker.
Different products distribute Brotli differently. Official Node.js builds bundle a copy, so their security version is tied to the Node.js release. Some Linux distributions instead link Node.js to a system library, meaning the relevant update can depend on the operating system package. Python applications may install Brotli or brotlicffi directly or through another package. The source cites requests/urllib3, aiohttp, httpx with its Brotli extra, and Scrapy as examples of clients that can decode compressed responses when the relevant package is installed.
The source reports that Imperva demonstrated code execution on an official Node.js image after several attempts. That is a reported demonstration, not evidence that attackers are exploiting the flaw broadly. It also says CISA’s data showed “exploitation: none” and that the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog as of the article’s date.
Exposure and Unfixed Copies
The full set of affected deployments is not established. The source cites an independent tracker listing more than 30 projects and packages that bundle their own Brotli copy, with seven still unfixed on October 26. That tracker’s status can change, and its list does not establish whether each listed copy is reachable through attacker-controlled input in a given installation.
It is also unclear from the supplied material how many systems have been attacked or how frequently the vulnerability is being exploited. The source reports no known exploitation in CISA data and no KEV listing at the time, while Imperva’s reported demonstration shows a code-execution outcome under test conditions. Neither fact establishes the threat level for every deployment. Operators should treat the issue as a serious patching priority without describing exploitation as widespread or confirmed in the wild.
The supplied material does not establish a connection between this vulnerability and a separate DreamHost password-reset incident mentioned in the source. DreamHost reportedly named no cause, and no evidence in the material links that incident to Brotli.
Patch, Restart, Then Verify
Operators should identify every place Brotli is included, check the vendor’s advisory for the supported fixed version, and update the relevant runtime, package, operating-system library or bundled tool. Where a product has no released fix, teams should follow its vendor’s guidance and track release notices rather than assume an update to a different layer will replace the vulnerable decoder.
After installing updates, restart affected services and workloads, then verify the running versions and container images. The source emphasizes that live processes retain the old decoder until restarted. Teams should also review applications that decode compressed responses, accept compressed request bodies, or process files with Brotli-enabled tools, and confirm whether those paths handle untrusted data.
Further updates are expected as vendors and projects release patches for bundled copies. The reported tracker status is a snapshot from October 26, 2026, not a final inventory. Administrators should check current advisories for their exact products and confirm that both the software and the running process have moved to a fixed build.
Key Questions
What is Broccoli2Shell?
It is the name used in the source material for the issue tracked as CVE-2026-111497, a flaw in the Brotli C decoder. The reported defect can cause an out-of-bounds memory write when malformed compressed input is treated as unfinished data.
Which software is affected?
The source lists Brotli 1.0.3 through 1.2.0 and downstream software that uses or bundles those decoder versions. Examples include Node.js, Python Brotli packages, Bun, Envoy, Istio and .NET, but exposure depends on the specific product build and version.
Is the vulnerability being exploited in the wild?
The supplied source says CISA data reported “exploitation: none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also reports an Imperva code-execution demonstration under test conditions. The material does not confirm attacks in the wild.
Is installing the update enough?
No. According to the source, a running process can keep using the old decoder after its files are updated. Restart affected services or workloads, then verify the version that is actually running.
What if my runtime has no listed fix?
The source lists no fix for Node.js 20, 23 or 25 as of October 26, 2026. Check current vendor guidance and release notices for the exact runtime you use, and assess whether it processes untrusted Brotli-compressed data while waiting for supported remediation.
Source: ThorstenMeyerAI.com
