🔍 Read the full analysis: What Broccoli2Shell Reveals About Shared Compression Dependencies on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli C decoder affects versions 1.0.3 through 1.2.0 and has reached multiple runtimes and software projects that bundle it. Fixes are available for several components, but affected running processes need to restart, and a tracker listed seven bundled copies as still unfixed on Oct. 26, 2026. No exploitation in the wild had been reported in the cited data.
A flaw in Google’s Brotli decoder can corrupt memory when it processes crafted compressed data, and a demonstration reportedly ran code on an unmodified Node.js build. The vulnerability, CVE-2026-111497, affects Brotli C library versions 1.0.3 through 1.2.0; fixes are now available across several runtimes, but software that bundles its own copy may still need separate updates.
The Node.js advisory describes a decoder error in which malformed input was treated as though more data might arrive, rather than rejected as invalid. The decoder could then write beyond an eight-byte internal buffer. The resulting memory corruption could crash a process or expose memory; code execution is a potential worst-case outcome, not a result established for every affected deployment. Google’s CVE record identifies an out-of-bounds write and an unchecked return value.
The source material reports a CVSS 4.0 score of 9.2, rated Critical. Imperva said it ran code against an official Node.js image after several attempts. That demonstration indicates the risk can extend beyond a denial-of-service crash, but does not by itself establish active attacks against users. The cited CISA data recorded no known exploitation, and the vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26.
Available fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. The source also lists patched releases for Envoy, Istio, .NET and Debian. Updating is not always enough: affected running processes retain their loaded decoder until restarted. Node.js 20, 23 and 25 are listed as receiving no fix.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
One Decoder, Many Software Stacks
The vulnerability matters because Brotli is not confined to a single application. Projects may use it through a runtime, install a Python package that wraps it, or bundle a copy directly. That creates a shared dependency problem: one defect can affect different products, and a patch to one layer does not necessarily repair every copy elsewhere in the system.
Exposure depends on how software handles compressed data. The source identifies automatically decoded web responses, accepted Brotli-compressed request bodies and tools that read compressed files as possible pathways. For example, Node.js’s built-in fetch() can decode Brotli responses, while Python clients may do so when a Brotli package is installed. Express versions listed in the source can inflate Brotli request bodies through certain parsers, but the flaw is in Brotli, not Express; upgrading Express alone is not a remedy. A bare Node.js HTTP server does not decode request bodies automatically.
For operators, the practical work goes beyond checking a top-level package version. Teams may need to identify bundled libraries in runtimes, proxies, containers and file-processing tools, apply the corresponding vendor release and restart processes. The issue also shows why a fix in an upstream source repository may not promptly reach downstream users: the library, runtime, distribution and deployed service can each have separate release schedules.
Popular right now
Dyson Car+Boat Cordless Handheld Vacuum
Ninja Luxe Café Mini Plus Espresso and Drip Coffee Machine with AutoFroth, Stainless Steel, ES351
iRobot Roomba Max 715 Pet Robot Vacuum with AutoEmpty Dock
As an affiliate, we earn on qualifying purchases.
From Source Fix to Security Release
The source fix was committed to the Brotli repository on February 27, 2026, with the commit title “Detect and report invalid stream earlier.” The source material says the commit did not describe the change as security-related. Releases containing the fix appeared on October 21, a gap of 236 days. OpenAI said the security significance was not known at the time and that no newer Brotli release had been made.
The CVE became public on October 22, and a public proof of concept appeared on GitHub that day, according to the cited tracker. Downstream awareness and coverage developed after that: the source says Python packages were missing from an advisory database on October 23, before GitHub’s advisory added them later the same day. As of October 26, the tracker listed more than 30 projects and packages that bundle their own copy, with seven still unfixed and five more fixed in their main branches.
The story follows another October security release: PHP addressed PHP2Shell on October 21, while Node.js issued a security release the same day that included the Brotli issue. OpenAI is credited by Node.js, and OpenAI said it found the flaw during red-teaming with teams of AI agents. Those statements describe the reported discovery process; they do not establish that AI systems independently verified every affected product or deployment.
“OpenAI Codex Security”
— Node.js security credits, as reported by ThorstenMeyerAI.com
Exposure and Exploitation Still Unclear
The number of systems that remain vulnerable is not established by the available source material. A tracker count of affected projects does not show how many installations use vulnerable builds, whether they process attacker-controlled compressed data, or whether operators have already patched and restarted their services.
The source reports no known exploitation in the wild as of October 26, based on CISA data, and says the CVE was not in CISA’s exploited-vulnerabilities catalog. That is a status report, not proof that exploitation has never occurred or cannot occur. The Imperva demonstration is distinct from evidence of attacks against public-facing systems.
Downstream status may also change after the reported date. Seven bundled copies were listed as unfixed on October 26, while five more had fixes in their main branches; a main-branch change does not necessarily mean a stable release is available. The source does not provide a complete inventory of affected deployments or confirm the patch status of every distribution, container image and software vendor.
Patch Releases and Restarts Ahead
Organizations using affected software should check the relevant runtime or package advisory, including whether the product links against a system Brotli library or includes its own copy. They should install the fixed release for that component and restart affected processes so the new decoder is loaded. A patch to a parent application is not sufficient when a separate bundled decoder remains vulnerable.
Downstream maintainers still need to publish fixes for products whose bundled copies were unfixed or only corrected in their main branches. Operators should monitor release and distribution advisories for those components. Further information about exploitation or confirmed exposure was not available in the cited material as of October 26, 2026.
Key Questions
What is CVE-2026-111497?
It is a vulnerability in Google’s Brotli C decoder, affecting versions 1.0.3 through 1.2.0. Malformed compressed input can trigger an out-of-bounds write and memory corruption.
Does the flaw affect only Node.js?
No. The decoder is used or bundled by multiple runtimes and projects. The source lists affected pathways involving Node.js, Python packages, Bun, Envoy, Istio, .NET and other software with its own bundled copy.
Which versions include fixes?
The listed fixed releases include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1; and brotlicffi 1.2.1.0. Check the relevant vendor advisory for other products and supported versions.
Is the vulnerability being exploited in the wild?
The cited CISA data reported no known exploitation as of October 26, 2026, and the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog. Imperva reported a code-execution demonstration, which is not the same as evidence of in-the-wild attacks.
Why must affected services restart after patching?
A running process can continue using the decoder already loaded into memory. According to the source, it must be restarted after updating to load the patched library.
Source: ThorstenMeyerAI.com
