Broccoli2Shell: One Compression Bug Reaches Node.js, Python And Beyond. What To Patch, Restart And Check

🔍 Read the full analysis: Broccoli2Shell: One Compression Bug Reaches Node.js, Python And Beyond. What To Patch, Restart And Check on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects software using vulnerable decoder versions from 1.0.3 through 1.2.0, with patches now available for Node.js, Python packages and other projects. The bug can corrupt memory when processing malformed compressed data; security firm Imperva reported that it achieved code execution in a demonstration using an unmodified Node.js build, while the cited CISA data reports no known exploitation in the wild.

The vulnerability is in the Brotli C decoder, not in a single programming language or web framework. According to the Node.js security advisory, the decoder could treat malformed input as incomplete data and continue writing beyond an eight-byte internal buffer. The resulting memory corruption can crash a process, expose memory, or potentially allow code execution, depending on the circumstances. The CVE record identifies an out-of-bounds write and an unchecked return value.

Fixes listed in the source material include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio, .NET and Debian. The source says Node.js 20, 23 and 25 have no fix. Administrators should check the versions and advisories relevant to their deployment rather than assuming an update to an application framework replaces its Brotli dependency.

Updating a package or runtime may not change a decoder already loaded by a running service. The source advises restarting processes after patching. Exposure varies: Node.js’s built-in fetch can decode compressed responses, while Python HTTP clients may use Brotli when an applicable package is installed. Some request parsers and file-processing tools also handle Brotli data. A basic Node.js HTTP server does not, by itself, decode request bodies.

Why Brotli Patches Reach Many Stacks

Brotli is used to compress web traffic and is distributed through runtimes, packages and software that bundle their own copy of its C decoder. A defect in that shared component can consequently affect unrelated applications, even when their developers did not write or directly manage the decoder. The source’s independent tracker lists more than 30 projects and packages with bundled copies, and says seven remained unfixed as of October 26; those figures reflect the tracker’s status at that date, not a complete count of every affected deployment.

This creates a supply-chain patching problem: a fix must reach the upstream library, then each runtime, package, distribution or container that includes it, and finally active processes. For operators, the practical task is to inventory how Brotli enters their systems, apply an available version, rebuild images where needed and restart affected services. The presence of a vulnerable dependency does not by itself establish that a particular service can be reached through attacker-controlled compressed input.

The source reports that Imperva ran code against an official, unmodified Node.js image after several attempts. That is a demonstration of potential impact, not evidence that attackers have exploited the vulnerability publicly. Google’s CVE record gives it a 9.2 Critical score under CVSS 4.0. The cited CISA data lists exploitation as none, and the vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog at the time reported.

From Brotli Commit to October Advisories

The source says the underlying code change entered the Brotli source repository on February 27, 2026, under the commit title “Detect and report invalid stream earlier.” It says the change did not describe itself as a security fix. OpenAI later said the security implications were not known at the time and that no newer Brotli release was available. Releases containing the fix appeared on October 21, a gap of 236 days between the source change and those releases, according to the source’s timeline.

The CVE became public on October 22, and a public proof of concept appeared that day, according to the cited tracker. The source also says that on October 23 some advisory databases did not yet list the Python packages, leaving dependency scanners without that advisory information until GitHub added it later that day. This sequence helps explain why patch availability and detection across downstream projects did not happen simultaneously.

The report credits OpenAI Codex Security in the Node.js disclosure and says OpenAI described finding the flaw during red-teaming with teams of AI agents. That is an attributed account of how the flaw was found; it does not establish that AI systems found every affected copy or that all downstream software has been checked. The source separately mentions DreamHost password resets after an incident, but says DreamHost named no cause and provides no evidence linking that incident to Brotli.

Exposure and Unpatched Copies

It remains unclear how many deployed services are vulnerable and reachable through attacker-controlled data. The source identifies seven bundled copies still unfixed in its tracker as of October 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; it also says five more projects had fixes in their main branches. A fix in a development branch does not necessarily mean a released package is available or installed.

The cited records report no known exploitation in the wild at the time covered, but that status can change and does not rule out unreported activity. The source does not provide a complete inventory of affected installations, a count of exposed services, or evidence establishing the exploitability of every affected integration. The DreamHost incident mentioned in the material has no stated cause and is not linked to this flaw.

Patch Releases and Restart Checks

Operators should use current advisories from their runtime, package maintainer, operating-system distributor and container-image provider to identify the relevant fixed release. They should update the Brotli component or software that bundles it, rebuild or replace affected images where applicable, and restart running processes so they load the patched decoder. Teams should also check whether their applications decode compressed responses, accept compressed request bodies, or process Brotli-compressed files.

Further updates are likely as downstream maintainers release fixes and trackers revise their lists. The source material does not give a deadline for the remaining projects or confirm when every distribution will ship patched packages. Security teams should treat the October 26 status as a snapshot and verify current release information before closing remediation work.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for the issue involving CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder. The source explains that the nickname comes from a comparison to zlib and the vegetable theme used for the issue.

Which software is affected?

The source lists vulnerable Brotli decoder versions from 1.0.3 through 1.2.0 and downstream software including Node.js, Python Brotli and brotlicffi, Bun, Envoy, Istio, .NET and some Linux packages. Whether an installation is affected depends on the decoder version it uses, including any copy bundled by the software.

Does upgrading Express fix the issue?

Not necessarily. The source says the flaw is in the Brotli decoder, not Express itself. Affected request-parsing configurations may use Brotli, so teams need to update the underlying runtime or dependency to a fixed version and check the relevant advisory.

Is the flaw being exploited in the wild?

The cited CISA data reported no known exploitation, and the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog as of the source’s October 26 report. Imperva’s code-execution demonstration shows potential impact but is not evidence of public exploitation.

Why must services restart after an update?

A running process can keep the old decoder loaded even after files or packages have been updated. Restarting affected processes is needed for them to load the patched code, according to the source material.

Source: ThorstenMeyerAI.com