🔍 Read the full analysis: Broccoli2Shell And Compression: What Node.js And Python Teams Need To Review on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and reaches Node.js, Python and other software that uses the library. Fixes are available for several runtimes and packages, but teams must check their specific dependencies and restart running processes; some bundled copies remained unfixed as of October 26, 2026. The source reports no confirmed in-the-wild exploitation.
Security fixes are spreading across Node.js, Python and other software for a memory-corruption flaw in Google’s Brotli decoder, identified as CVE-2026-111497. The vulnerability affects Brotli versions 1.0.3 through 1.2.0; teams need to identify whether their applications use affected copies, update to a fixed release and restart processes that may still have the old decoder loaded.
The flaw involves malformed compressed data that the decoder can treat as incomplete rather than invalid. According to the Node.js security advisory, this can cause writes beyond an internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on how the flaw is reached and the surrounding software, memory corruption could cause a crash, expose memory contents or, in a severe case, enable code execution.
Imperva reported that it ran code on an unmodified official Node.js image after several attempts. That is a demonstration of potential impact, not evidence that attackers have used the flaw against real systems. The source says Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0; it also reports that CISA lists exploitation as “none” and that the CVE was not in the Known Exploited Vulnerabilities catalog as of October 26.
Fixed releases listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Fixes are also listed for Envoy, Istio, .NET and Debian releases. The source says Node.js 20, 23 and 25 have no fix. Teams should confirm the applicable release against the advisory for their platform rather than assume that updating an application framework also updates Brotli.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli Reaches Many Stacks
Brotli is used to compress web data, and the decoder can arrive in an application through a runtime, a package or a separately bundled copy. That means the issue is not limited to services that directly call Brotli. Node.js’s built-in fetch() can decode Brotli responses, while Python HTTP clients may do so when a Brotli package is installed. Webhooks, crawlers, link previews and tools that import data from URLs may therefore need review, depending on their configuration and dependencies.
Exposure also depends on what a system processes. Some Express and body-parser versions inflate Brotli request bodies, but the source stresses that the vulnerability is in the decoder, not Express itself: upgrading Express alone does not necessarily fix it. A bare Node.js HTTP server does not decode request bodies automatically. Archives, fonts, data files and firmware tools can also use the C library. These differences make dependency and deployment inventory more useful than a blanket assumption that every Node.js or Python service is equally exposed.
Updating a package is not always the last step. A running process can keep using the decoder already loaded into memory, so the source advises teams to patch and restart. Container images, system libraries and bundled copies may each have separate update paths. The spread of the bug illustrates how a defect in a shared component can require coordinated fixes throughout a software supply chain.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
DJI Osmo Mobile 8 3-Axis Smartphone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
From Source Fix to Runtime Releases
The source traces the underlying code change to February 27, 2026, when a Brotli source commit titled “Detect and report invalid stream earlier” was made. It says that commit did not describe the change as security-related. OpenAI later stated on X that the security significance was not known at the time and that Brotli had not had a more recent release. The source calculates a 236-day gap between the code change and October releases carrying the fix.
Several projects released fixes on October 21, and the CVE became public on October 22, according to the supplied account. A public proof of concept also appeared that day, the account says. On October 23, some Python packages were reportedly missing from advisory databases, leaving dependency scanners without an entry to flag. The source says GitHub’s advisory record added them later that day.
As of October 26, an independent tracker cited by the source listed more than 30 projects and packages with bundled copies, seven of them still unfixed. Those included DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. Five other projects were reported to have fixes in their main development branches. The tracker is a snapshot, not a guarantee of current status; maintainers’ advisories remain the place to verify release details.
Exposure and Unpatched Copies
The supplied source reports no confirmed exploitation in the wild, but that status can change and does not rule out attacks that have not been detected or reported. Imperva’s code-execution demonstration establishes a possible outcome under its test conditions; it does not establish how easily the flaw can be exploited across different deployments.
Which systems are reachable depends on how Brotli is included and used. Official Node.js builds reportedly bundle their own copy, while some Linux distributions link Node.js to a system library. Python clients may require an optional compression package. The exact exposure of an application cannot be established from its language or framework alone.
The tracker’s count of seven unfixed bundled copies reflects its October 26 snapshot. The source does not provide a complete, current list of affected deployments or establish when every listed maintainer will publish a release. It also says Node.js 20, 23 and 25 receive no fix, but gives no further detail here about upgrade options or support timelines for each team.
Patch, Restart and Verify
Engineering and security teams should check their lockfiles, software bills of materials, runtime versions, operating-system packages and container images for affected Brotli copies. They should compare each result with the relevant vendor advisory, update to a listed fixed release where available and restart services so updated libraries are loaded. Teams relying on a system package or a vendor-bundled copy should follow that distributor’s release notes rather than assume an application-level update is sufficient.
Where a dependency has no published fix, teams should monitor its maintainer’s security notices and assess whether the affected decoding path handles untrusted data. The source does not provide a universal mitigation that makes every affected configuration safe. It also reports that some projects had fixes only in their main branches as of October 26, so production users should verify whether a tagged release is available.
Patch status is likely to keep changing as downstream projects, distributions and package registries update their records. The next useful milestone for affected teams is confirmation that every deployed copy has a fixed version—or a documented response for components that remain unpatched—followed by checks that running workloads have restarted successfully.
Key Questions
What is Broccoli2Shell?
Broccoli2Shell is the name used for the security issue involving malformed Brotli-compressed input. The source identifies it as CVE-2026-111497 and says the flaw is in Google’s Brotli decoder, not in Node.js or Express itself.
Are Node.js and Python applications all affected?
No. Exposure depends on the Brotli version, how it is bundled and whether the application reaches the decoder. Teams should inspect runtime builds, dependencies and system packages, then check the relevant advisories.
Which versions include fixes?
The source lists Node.js 22.23.4, 24.22.1 and 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0, and Brotli library releases 1.0.10, 1.1.1 and 1.2.1. Other projects have separate fixed versions; verify them with their maintainers’ advisories.
Does upgrading the package remove the risk immediately?
Not necessarily. A process may keep the old decoder loaded until it is restarted. The source recommends updating and restarting, then verifying the version actually used by deployed services and containers.
Has the flaw been exploited in real attacks?
The supplied source reports no known in-the-wild exploitation as of October 26, 2026, citing CISA data. It describes an Imperva demonstration that ran code on an official Node.js image, but a demonstration is not evidence of attacks against real-world targets.
Source: ThorstenMeyerAI.com
