Patch, Restart, Check: A Practical Guide To The Broccoli2Shell Bug

🔍 Read the full analysis: Patch, Restart, Check: A Practical Guide To The Broccoli2Shell Bug on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security fixes are available for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder that affects versions 1.0.3 through 1.2.0 and is included in multiple runtimes and software packages. The issue matters beyond any one programming language: operators need to identify which decoder their systems use, update to a fixed release and restart running processes to load the patched code.

The decoder mishandles a type of malformed compressed input, treating it as incomplete rather than invalid. The source material says this can cause data to be written past an eight-byte internal buffer. The CVE record describes an out-of-bounds write and an unchecked return value. Potential consequences include a process crash or memory corruption; the material says code execution is possible in the worst case.

According to the source, fixed releases include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Listed fixes also include Envoy, Istio, .NET and Debian releases. Node.js versions 20, 23 and 25 are listed as receiving no fix.

The vulnerability can reach systems through applications that automatically decode compressed responses, services that accept and inflate compressed request bodies, or tools that process Brotli-compressed files. Exposure depends on how a product uses the library. A bare Node.js HTTP server, for example, does not decode request bodies on its own, according to the source. Updating a framework alone may not be enough if the vulnerable decoder is a separate dependency.

Why Brotli’s Reach Matters

Brotli is used to reduce the size of web data, and its decoder is embedded in software across languages and infrastructure. That makes this a dependency-chain problem: a patch to the underlying C library must reach each runtime, package, distribution or application that bundles it. A system may remain vulnerable even if its main application appears up to date.

Operators should check both direct and bundled dependencies, then confirm the running service has been restarted. A package manager reporting a new version does not, by itself, show that a process already in memory has switched to the fixed decoder. Teams that accept compressed uploads, retrieve remote content or process compressed files should establish which code paths are enabled before prioritizing remediation.

The source material reports that Imperva demonstrated code execution on an unmodified official Node.js image after several attempts. That is a reported demonstration, not evidence that attackers are exploiting the flaw broadly. The same material says Google’s CVE record gives it a 9.2 Critical score under CVSS 4.0, while CISA data lists exploitation as “none” and the CVE is absent from CISA’s Known Exploited Vulnerabilities catalog.

From Brotli Fix to Runtime Updates

The underlying source change was committed on February 27, 2026, under the title “Detect and report invalid stream earlier.” The source material says the commit did not describe the issue as a security vulnerability. Releases containing the fix appeared on October 21, a reported gap of 236 days. OpenAI said the security significance was not known at the time of the change and that no newer Brotli release was available.

The CVE became public on October 22, and the source says a public proof of concept appeared on GitHub that day. It reports that Node.js credited OpenAI Codex Security and that OpenAI described finding the flaw during red-teaming with teams of AI agents. Those details describe the reported discovery process; they do not establish how often the vulnerability is being targeted.

As of October 26, an independent tracker cited by the source listed seven bundled copies still unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. It also listed five projects with fixes in their main branches. Those counts are a dated tracker snapshot, not a complete measure of all affected software.

Exposure and Exploitation Remain Unclear

The source material reports no confirmed in-the-wild exploitation in the cited CISA data, but that status can change and does not rule out unreported activity. It also does not provide a complete inventory of every affected product, version or deployment. Some projects bundle their own Brotli copy, while others use a system library, so version checks may need to account for build and distribution choices.

The practical conditions for reaching vulnerable code differ by application. A dependency’s presence alone does not establish that an exposed input path is enabled. The supplied information does not establish how many systems are vulnerable, whether specific organizations have been attacked, or when each remaining project will publish a release. A separate DreamHost password reset mentioned in the source has no stated cause and no established link to Brotli.

Track Fixes Through Each Deployment

Organizations should compare their runtime, package and operating-system versions with vendor advisories, including software that bundles Brotli rather than relying on a system library. After installing a fixed version, they should restart affected services and verify that the running process uses the updated component. Teams should also monitor advisories from projects whose bundled copies were still listed as unfixed in the October 26 tracker snapshot.

The next milestones are further vendor and distribution updates, plus clearer confirmation of which bundled projects have shipped fixes. Security teams should treat the reported exploitation status as a dated snapshot and review it again as advisories develop.

Key Questions

What is Broccoli2Shell?

It is the name used for CVE-2026-111497, a flaw in Google’s Brotli decoder. The source material says malformed compressed input can trigger an out-of-bounds write and memory corruption.

Which versions are reported as fixed?

The listed fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1; and brotlicffi 1.2.1.0. Check the relevant vendor advisory for other products and distributions.

Is upgrading enough, or must services restart?

A restart is needed for a running process to load the patched decoder, according to the source material. After updating, verify that affected services have restarted and are using the fixed component.

Is the flaw being exploited in the wild?

The source says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the report date. That is a dated status, not a guarantee that exploitation has not occurred or will not occur.

Does this affect every Node.js application?

No. Exposure depends on the Node.js version, bundled or system Brotli library, and whether the application reaches a vulnerable decoding path. The source says official Node.js builds bundle Brotli, while some Linux distributions use a system library; it also says a bare Node.js HTTP server does not automatically decode request bodies.

Source: ThorstenMeyerAI.com