🔍 Read the full analysis: Broccoli2Shell: Connecting One Compression Bug To Multiple Stacks on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli decoder affects multiple runtimes and applications that use vulnerable versions. Fixes are available for major platforms, but some bundled copies remain unpatched, and patched services must be restarted to load the corrected decoder.
A flaw in Google’s Brotli decoder, identified as CVE-2026-111497, can corrupt memory when software processes crafted compressed data, and Imperva demonstrated code execution on an unmodified Node.js build. Security fixes have since been issued for Node.js, Python packages, Bun, Envoy, Istio, .NET and other components, but several projects that bundle Brotli remain unpatched, according to the October 26 report from ThorstenMeyerAI.com.
The vulnerability affects the C decoder in Brotli versions 1.0.3 through 1.2.0. The Node.js advisory describes a condition in which malformed input was treated as incomplete data rather than invalid data. The decoder could then write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on how a vulnerable component is used, memory corruption can cause a crash, expose data or potentially enable code execution.
Imperva reported that it ran code on an official Node.js image after several attempts. That is a demonstration, not evidence that attackers are exploiting the flaw in live systems. Google’s CVE record assigns the issue a CVSS 4.0 score of 9.2, Critical; CISA data cited in the report lists exploitation as “none,” and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog.
Fixed releases listed in the report include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updated releases of Envoy, Istio and .NET. Debian updates are also listed. A patched package does not update a decoder already loaded by a running process, so operators need to restart affected services after applying fixes.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Exposed Components
The issue matters because Brotli is reused across software stacks, rather than being confined to one application. Node.js can decode Brotli responses through its built-in fetch function, while Python HTTP clients may do so when a Brotli package is installed. Webhooks, crawlers, link previews and features that import data from a URL can therefore encounter compressed responses. Other exposure paths include applications that accept compressed request bodies and tools that process files such as archives or fonts.
The breadth of use complicates patching. An organization may need to update not only a language runtime but also packages, proxies, distributions, container images and separately bundled copies of the C library. The report says an independent tracker listed more than 30 projects and packages with bundled copies, with seven still unfixed as of October 26. That count is the tracker’s snapshot, not a complete inventory of every deployment.
For defenders, the immediate practical point is to check the component that actually supplies the decoder. Upgrading a framework alone may not help: the source report says the bug is in Brotli, not Express, and that Express versions using vulnerable Brotli packages can inflate compressed request bodies. Systems that bundle their own decoder may require a vendor-specific update even after a system library is patched.
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Release
The source report traces the correction to a Brotli code change made on February 27, 2026, titled “Detect and report invalid stream earlier.” The change did not identify the issue as a security vulnerability, according to the report. OpenAI said on X that the security significance was not known at the time and that no newer Brotli release was available. Releases carrying the fix appeared on October 21, leaving a reported 236-day gap between the source-code change and those releases.
The CVE became public on October 22, and a public proof of concept appeared on GitHub that day, according to the cited tracker. The correction then had to pass through projects that depend on Brotli. The report says that on October 23 some Python package advisories were absent from advisory databases, leaving dependency scanners without those entries until GitHub’s advisory was added later that day.
The disclosure also drew attention to AI-assisted security review. Node.js credited OpenAI Codex Security, and OpenAI said it found the vulnerability during red-teaming with teams of AI agents. That account describes how the flaw was found; it does not by itself establish how many other vulnerabilities such methods can identify or how reliably they do so.
“A bigger deal than PHP2Shell.”
— Security researcher Juliano Rizzo, as quoted by broccoli2shell.com
network security monitoring appliance IDS IPS
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Exploitation and Remaining Copies
As of the report’s October 26 publication, the cited CISA data showed no known exploitation, and the CVE was not listed in the agency’s Known Exploited Vulnerabilities catalog. Those details do not rule out activity that has not been detected or reported. Imperva’s demonstration shows a potential impact under test conditions, not confirmed attacks against deployed Node.js services.
The report says seven bundled copies were still unfixed, naming DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools among them. It also says five other projects had fixes in their main branches, which does not necessarily mean those fixes had reached stable releases. The status of each product can change, and users should consult its current maintainer advisory.
Exposure also depends on how software is configured and used. A library may be present without a vulnerable decoding path being reachable from untrusted input. The report does not provide a complete inventory of affected deployments, nor does it establish that every listed product can be exploited in the same way.
secure backup drive encrypted hardware
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch, Restart, Check Bundles
Operators should identify which Brotli implementation their applications use, compare its version with the applicable vendor advisory, and apply a fixed release where available. They should also restart running processes after updating: the report warns that an already-running service continues using its old decoder until it restarts. For bundled copies, teams may need to wait for a project-specific release or use guidance from the maintainer rather than relying on an operating-system library update.
Further updates are likely as downstream projects publish fixes and distributions update packages. The report does not give a single deadline for remaining vendors or a confirmed timeline for all outstanding releases. It also notes that Node.js 20, 23 and 25 receive no fix in the versions listed, so users of those release lines should check the Node.js project’s support and migration guidance.
The separate password-reset notice from DreamHost is not linked to this vulnerability: the source says DreamHost named no cause for its email and FTP/SFTP resets. Organizations should treat that notice and the Brotli issue as distinct developments unless either company provides evidence connecting them.
Key Questions
What is CVE-2026-111497?
It is a flaw in Google’s Brotli C decoder. Crafted malformed compressed data can trigger an out-of-bounds write, corrupting memory in software that uses affected versions.
Does the flaw mean attackers are already exploiting systems?
Not according to the information cited in the October 26 report. CISA data listed exploitation as “none”, and the CVE was not in its Known Exploited Vulnerabilities catalog. Imperva demonstrated code execution in testing, which is different from confirmed attacks in the wild.
Which software has fixes?
The report lists fixes for Brotli, selected Node.js versions, Python’s Brotli and brotlicffi packages, Bun, Envoy, Istio, .NET and Debian packages. Exact fixed versions vary by product; users should check the relevant maintainer advisory and account for any bundled decoder.
Why must affected services restart after an update?
A running process may keep the old decoder loaded even after its files are updated. Restarting the service is needed for it to load the patched code, according to the source report.
Are all projects that bundle Brotli patched?
No. The tracker cited by the report listed seven bundled copies as still unfixed on October 26, while five more had fixes in their main branches. Those statuses can change, and a main-branch fix may not yet be available in a stable release.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
