🔍 Read the full analysis: How To Patch And Check The Broccoli2Shell Compression Bug Across Node.js And Python on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has fixes in several runtimes and packages. Update affected software and restart processes; some bundled copies remain unfixed, while no exploitation in the wild has been reported in the cited sources.
Security updates are available for a memory-corruption flaw in Google’s Brotli decoder, CVE-2026-111497, which can affect applications that process crafted compressed data. The vulnerability spans Brotli versions 1.0.3 through 1.2.0 and has fixes for Node.js, Python packages and several other products; affected services must be restarted after patching to load the corrected decoder.
The reported flaw occurs when the decoder treats malformed compressed input as incomplete data and continues processing it. The Node.js advisory says this can lead to an out-of-bounds write. Depending on the application and conditions, memory corruption can cause a crash, expose memory contents or potentially enable code execution. Google’s CVE record lists an out-of-bounds write and an unchecked return value. The fix makes the decoder reject the malformed stream with a format error.
Fixed versions listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. The listed fixes also include Envoy, Istio, .NET and Debian releases. Administrators should check the advisory for the specific version and distribution they use rather than assume that updating one application updates every bundled decoder.
Exposure depends on how software handles Brotli data. Node.js built-in fetch decodes Brotli responses automatically, while Python clients may do so when a Brotli package is installed. Some web frameworks and body parsers also inflate compressed request bodies. Files and tools that use the C decoder can be affected too. The flaw is in Brotli, not Express: upgrading Express alone does not fix a vulnerable Brotli copy. Official Node.js builds bundle Brotli, so their Node.js release is the relevant fix; some Linux packages instead use the system library.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Patch Every Brotli Decoder
The issue matters because Brotli is reused across languages and software stacks. A single vulnerable decoder can reach services through outbound responses, incoming request bodies or files, depending on the software’s configuration and features. Teams may have to check more than their direct application dependencies: runtimes, operating-system packages, containers and tools can carry separate copies.
The source reports that Imperva demonstrated code execution on an official Node.js image after several attempts. That is evidence of a demonstration, not proof that every affected deployment is exploitable in the same way. The cited CISA data says “exploitation: none,” and the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog. The source therefore describes a serious vulnerability but does not report confirmed exploitation in the wild.
A fix in a package is not active in a process that has already loaded the old decoder. After upgrading, operators need to restart affected services and confirm that deployed images and workers use the patched build. The source also identifies seven bundled copies that remained unfixed in the tracker’s October 26 snapshot, making inventory and follow-up important even after common runtimes are updated.
Popular right now
Shark Navigator Robot Vacuum with Self-Empty Base, Dark Grey (RV2120AE)
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, KSM150PS, Almond Cream
Bose QuietComfort Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones, Eucalyptus Green
As an affiliate, we earn on qualifying purchases.
From Brotli Commit to Runtime Fixes
The source says the underlying change entered Brotli’s source code on February 27, 2026, under a commit titled “Detect and report invalid stream earlier.” It was not described as a security fix at the time. OpenAI said on X that the security significance was not then known and that no newer Brotli release was available. Releases containing the fix appeared on October 21, a gap of 236 days.
The CVE became public on October 22, according to the source, and a public proof of concept appeared on GitHub that day. The source says fixes then began moving through libraries, runtimes and distributions. It also reports that a tracker listed more than 30 projects and packages bundling their own Brotli copy, with seven still unfixed as of October 26; those tracker counts are a dated snapshot, not a complete inventory of every deployment.
Node.js credits OpenAI Codex Security, and OpenAI said it found the flaw during red-teaming with teams of AI agents. That account concerns how the vulnerability was discovered; it does not change the technical scope or establish that all affected copies have been patched. The source gives a CVSS 4.0 score of 9.2, rated Critical in Google’s CVE record.
“A bigger deal than PHP2Shell.”
— Juliano Rizzo, as quoted by the broccoli2shell.com tracker
Remaining Gaps in Patch Coverage
It is not yet clear from the supplied material how many systems remain exposed in production, or how many organizations have completed updates and restarts. A list of affected projects does not show whether a particular deployment processes attacker-controlled compressed data, and the source does not provide a universal test to establish exploitability across configurations.
The tracker cited by the source listed seven bundled copies as unfixed on October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. That status can change, and some projects may use system libraries rather than the copy named in a tracker. The source also says Node.js 20, 23 and 25 have no fix; it does not establish that those versions will receive later updates. Confirm the status with the relevant vendor or distribution.
The source reports no known exploitation in the wild in the cited records, but that is a status report, not proof that exploitation cannot occur or that every incident would be detected. It also mentions DreamHost password resets after a separate incident; it gives no cause and provides no evidence linking that incident to Brotli.
Verify Updates and Restart Services
Organizations should identify where Brotli is present, check vendor advisories for the exact runtime, package and operating-system versions, and deploy the corresponding fixed release. Pay particular attention to containers, base images, language dependencies and tools that bundle their own decoder. Where the vendor has not yet published a fix, teams should track its advisory and review whether the affected component accepts compressed data from untrusted sources.
After updating, restart processes and replace running containers or workers so they load the patched code. Then verify the version in the deployed environment, not only in a development lockfile or build manifest. Because fixes are arriving through different release channels, patch status should be checked again against current vendor and distribution notices rather than relying solely on the October 26 tracker snapshot.
Key Questions
What is CVE-2026-111497?
It is a vulnerability in Google’s Brotli decoder. The supplied source says malformed compressed input can trigger an out-of-bounds write and memory corruption in affected versions 1.0.3 through 1.2.0.
Which Node.js versions have the listed fix?
The source lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. It says Node.js 20, 23 and 25 have no fix; check current Node.js advisories for any later changes.
Is updating a Python dependency enough?
It may not be. The listed fixed releases are Python Brotli 1.2.1 and brotlicffi 1.2.1.0, but applications can also use Brotli bundled by another dependency, operating-system package or container image. Check the actual deployed components.
Do services need to be restarted after patching?
Yes. According to the source, a running process continues using the decoder it already loaded. Restart affected processes after installing the fix and verify that the new version is active.
Has the flaw been exploited in the wild?
The supplied source reports no known exploitation in the cited CISA data and says the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. It also describes an exploitation demonstration by Imperva, which is not the same as confirmed real-world attacks.
Source: ThorstenMeyerAI.com
