Could Broccoli2Shell Affect Your Apps? Check Compression Dependencies

🔍 Read the full analysis: Could Broccoli2Shell Affect Your Apps? Check Compression Dependencies on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get everyday essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

CVE-2026-111497, dubbed Broccoli2Shell, is a critical flaw in Google’s Brotli C decoder that can corrupt memory when it handles crafted compressed input. Updates are available for several widely used runtimes and packages, including Node.js and Python libraries, but security researchers are still tracking projects that have not released fixes. Teams need to check which decoder their software uses, update it and restart affected processes.

The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0. The Node.js advisory describes malformed input that the decoder incorrectly treats as incomplete rather than invalid. It can then write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Memory corruption can cause a crash or expose data; code execution is a possible worst-case consequence.

Fixed releases include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and updates for Envoy, Istio and .NET. The source also lists fixes for Debian releases. Node.js 20, 23 and 25 are listed as receiving no fix, so operators on those versions should consult their maintainers for supported upgrade options.

The exposure depends on how software uses Brotli. Node’s built-in fetch can decode compressed responses, while Python HTTP clients may do so when a Brotli package is installed. Express and body-parser versions listed in the source can inflate Brotli request bodies, but the flaw is in the decoder dependency, not Express itself. File-processing tools can also be affected. Updating a package does not change code already loaded by a running process: the process must be restarted after deployment.

How the Decoder Reaches Applications

Brotli is used to compress data for transmission and storage, and its decoder is reused or bundled in many software stacks. That makes the flaw relevant beyond one language or product: a developer may not have added Brotli directly, yet an HTTP client, runtime, proxy, archive tool or other dependency may include it. The practical task is to identify the actual decoder in use, including copies bundled inside applications and operating-system packages.

The source reports that Imperva demonstrated code execution on an unmodified Node.js build after several attempts. That is a reported demonstration, not evidence that attackers are exploiting the flaw broadly. Google’s CVE record assigns a CVSS 4.0 score of 9.2, rated Critical. The supplied material says CISA’s data lists exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the report date. The risk warrants prompt patching, while the available evidence does not establish exploitation in the wild.

For organizations, the issue also shows why inventory and deployment matter as much as a direct dependency list. A patched library is not enough if a container image still carries an old runtime, a bundled copy remains in a tool, or a long-running service has not been restarted. The reported scale of Python Brotli package downloads—about 83 million in the month checked on October 26, according to pypistats.org—illustrates use, but does not by itself measure vulnerable installations.

Products Worth Considering

DJI Osmo Mobile 8 3-Axis Smartphone Gimbal Stabilizer

AmazonView Latest Price

Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite

AmazonView Latest Price

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

From Source Fix to October Releases

The underlying code change was committed to Brotli on February 27, 2026, under the title “Detect and report invalid stream earlier.” The source says the commit did not identify the change as security-related. OpenAI later said the vulnerability was not known at the time and Brotli had no more recent release. Versions containing the fix began appearing on October 21, a gap of 236 days between the source change and those releases.

The CVE became public on October 22, alongside a public proof of concept, according to the cited tracker. From there, fixes had to move through projects that package or bundle Brotli, then into operating-system releases, container images and deployed services. The source reports that on October 23 Python package advisories were initially absent from advisory databases, leaving some dependency scanners without an entry to flag; GitHub’s advisory was added later that day.

The issue was initially one item in a Node.js security release, but the response has broadened as other maintainers issued updates. An independent tracker cited by the source lists more than 30 projects and packages that bundle their own copy. As of October 26, it lists seven bundled copies as still unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. The tracker is a point-in-time source, and project status can change as maintainers publish updates.

“A bigger deal than PHP2Shell”

— Juliano Rizzo, security researcher, as quoted by the cited Broccoli2Shell tracker

Open Questions on Exposure and Fixes

The source says CISA data showed no known exploitation as of October 26, but that status does not rule out private or subsequently discovered attacks. The reported Imperva demonstration establishes that code execution was possible in its test after several attempts; the supplied material does not provide enough technical detail to assess how reliably that result applies to other deployments.

It is not yet clear how many internet-facing services use vulnerable decoders, how many organizations have updated and restarted them, or when every project with a bundled copy will issue a release. The list of unfixed projects is dated October 26 and may change. Linux distributions can also differ in whether Node.js uses a bundled Brotli copy or a system library, so the runtime version alone may not describe every installation.

The source also mentions DreamHost password resets after an incident, but says the company named no cause and that nothing links the incident to Brotli. Those events should not be treated as connected. The supplied reporting does not establish that the password resets resulted from this vulnerability.

Patch, Restart and Verify Deployments

Operators should first check runtime, package and operating-system advisories against their deployed versions, including indirect dependencies and bundled copies. They should apply the fixed release that matches their supported platform, rebuild affected images where needed, and restart services so they load the updated decoder. A package upgrade without a process restart may leave the vulnerable code active in memory.

Teams should also review whether applications automatically decode compressed responses, accept compressed request bodies, or process Brotli-compressed files. Where an affected component has no published fix, maintainers’ advisories and the project’s release tracker are the next sources to check; the supplied material does not specify a single workaround that applies to every product. Security teams can continue monitoring CISA and vendor advisories as the status of bundled copies changes.

The next milestones are further project releases and updated distribution or container packages. The source credits Node.js with acknowledging OpenAI Codex Security and says OpenAI described the discovery as coming from red-teaming with teams of AI agents. That attribution concerns how the flaw was found; it does not change the immediate response required from users of vulnerable builds: identify, patch and restart.

Key Questions

What is Broccoli2Shell?

It is the name used for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The source identifies affected decoder versions as 1.0.3 through 1.2.0.

Does this affect every app that uses compression?

No. Exposure depends on whether an application, runtime, package or bundled tool uses an affected Brotli decoder and processes relevant compressed input. Check indirect dependencies and bundled copies, not just direct package declarations.

What should Node.js users update to?

The source lists fixed releases 22.23.4, 24.22.1 and 26.12.1. It says Node.js 20, 23 and 25 receive no fix, so users on those lines should consult the project guidance about supported options.

Is the flaw being exploited in the wild?

The supplied source says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. Imperva reported a code-execution demonstration, but that is not the same as confirmed real-world exploitation.

Is installing the update enough?

Not necessarily. A running process may keep using the decoder it loaded before the update. Deploy the fixed component and restart affected processes; rebuild or replace images if they contain an older bundled copy.

Source: ThorstenMeyerAI.com