🔍 Read the full analysis: What The Broccoli2Shell Bug Means For Node.js, Python, And Other Stacks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli decoder affects versions 1.0.3 through 1.2.0 and reaches software that bundles or uses the library, including Node.js and Python packages. Patches are available for several runtimes and platforms, but some bundled copies remain unfixed; running processes need to restart to use updated code. CISA reports no known exploitation in the wild, while an Imperva demonstration achieved code execution on an unmodified Node.js build.
Security fixes for CVE-2026-111497, a flaw in Google’s Brotli decoder, now cover Node.js, Python packages and several other software stacks, but projects that bundle their own copy still need to check for updates. The flaw affects decoder versions 1.0.3 through 1.2.0; a crafted compressed stream can corrupt memory, and Imperva reported running code on an unmodified Node.js build in a demonstration. CISA’s data lists no exploitation, so the demonstration should not be read as evidence of attacks in the wild.
The bug occurs when the decoder treats certain malformed compressed input as incomplete and continues writing beyond an eight-byte internal buffer, according to the Node.js advisory. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on how a vulnerable application handles the input, memory corruption could crash a process, expose memory contents or potentially enable code execution. The fix makes the decoder stop with a format error.
Published fixes include Google’s Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; and Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The source also lists fixes for Bun, Envoy, Istio, .NET and Debian releases. Node.js 20, 23 and 25 are listed as receiving no fix. Teams should check the specific runtime or package they deploy rather than assume that updating an application framework also updates Brotli.
Exposure depends on how software processes compressed data. Node’s built-in fetch() decodes Brotli responses; Python HTTP clients can do so when a Brotli package is installed. The source also identifies Brotli request-body parsing in certain Express and body-parser versions, as well as tools that process compressed files. A bare Node.js HTTP server does not decode request bodies automatically. Official Node.js builds bundle Brotli, while some Linux distributions use the system library, so the relevant patch can differ by build.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Chains
The breadth of affected software reflects how a shared native library can travel through runtimes, packages, distributions and container images. A team may not depend directly on Brotli: it can arrive through a runtime’s built-in features, a Python package, a proxy, or a tool that reads compressed files. That makes inventory and patch verification more involved than updating one named application.
Updating a package is not enough if a service continues running the old decoder in memory. The source material advises teams to patch and restart affected processes. Operators should also identify whether their software uses a bundled copy or a system library, since those are updated through different release channels. The reported code-execution demonstration raises the potential severity, but current information does not establish widespread exploitation or a confirmed active campaign.
Products Worth Considering
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From February Fix to October Releases
The source reports that the underlying correction entered Brotli’s source code on February 27, 2026, in a change titled “Detect and report invalid stream earlier.” It says the change was not identified as a security fix at the time. Releases carrying the correction appeared on October 21, a gap of 236 days, according to the source. The vulnerability became public the next day, alongside a public proof of concept, according to the tracker cited in the report.
Node.js initially included the issue among several vulnerabilities in an October 21 security release and rated it High. Since then, fixes have appeared in additional packages and platforms. The source’s tracker listed more than 30 projects and packages with bundled copies, and reported that seven remained unfixed as of October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. These tracker figures are time-sensitive, not a final count.
Node.js credits OpenAI Codex Security in its advisory. OpenAI said it found the issue during red-teaming with teams of AI agents. That account concerns how the flaw was found; it does not change the need for maintainers to assess and ship fixes across downstream projects.
“The decoder treated malformed input as “waiting for more data” instead of “this is broken.””
— Node.js security advisory, as summarized by ThorstenMeyerAI.com
Exposure and Remaining Copies
The available material does not establish how many systems are vulnerable or whether attackers have exploited the flaw outside demonstrations. CISA’s data says “exploitation: none,” and the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, according to the source. Those indicators do not prove that no exploitation has occurred; they describe the current public record cited in the report.
The number of unpatched bundled copies may change as maintainers release updates. The source says seven projects were still unfixed on October 26 and five others had fixes in their main branches, but does not establish when all of those changes will reach stable releases. Exposure also depends on whether an application accepts or processes attacker-controlled Brotli data and on the exact build in use.
Patch, Restart and Track Releases
Operators should identify their Brotli dependencies, apply the matching vendor or runtime update, and restart affected processes so they load the fixed decoder. Teams should review transitive dependencies and software with bundled native libraries, including internal tools and file-processing services, and follow maintainers’ advisories where no stable fix is listed.
Further updates are likely as downstream projects and Linux distributions publish releases. The source does not give a single deadline for those updates or report a complete inventory of affected deployments. Organizations should use current vendor notices and package records to confirm whether their particular version has been fixed, rather than relying on the status of a different stack.
Key Questions
What is the Broccoli2Shell bug?
It is the name used for CVE-2026-111497, a flaw in Google’s Brotli decoder. Malformed compressed input can trigger an out-of-bounds write and memory corruption.
Does the bug affect Node.js and Python?
Yes, according to the source. Fixed releases include Node.js 22.23.4, 24.22.1 and 26.12.1, plus Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Check the version and build used by your application; Node.js 20, 23 and 25 are listed as having no fix.
Is the vulnerability being exploited in the wild?
The source reports that CISA’s data lists no exploitation and that the CVE is not in its Known Exploited Vulnerabilities catalog. Imperva demonstrated code execution on an unmodified Node.js build, but that does not establish active attacks in the wild.
Is updating a dependency enough?
Not necessarily. Running processes may continue using the old decoder until restarted, and software can bundle its own Brotli copy. Confirm the relevant runtime, package or system-library fix, then restart affected services.
Source: ThorstenMeyerAI.com
