🔍 Read the full analysis: Broccoli2Shell: A Field Guide To Fixing A Cross-Stack Compression Bug on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A memory-corruption flaw in Google’s Brotli C decoder affects versions 1.0.3 through 1.2.0 and has been carried into multiple runtimes and applications. Fixes are available for several major projects, but teams must update the right component and restart affected processes; exploitation in the wild has not been reported in the supplied source material.
CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, has triggered security updates across Node.js, Python packages and other software stacks that use the compression library. The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0; patches are available for several widely used projects, while some bundled copies remain unfixed, according to the October 26 report by ThorstenMeyerAI.com.
The bug occurs when the decoder handles a malformed compressed stream as though it were incomplete input. According to the Node.js advisory cited in the report, that can cause the decoder to write beyond an eight-byte internal buffer. The resulting memory corruption could crash a process or, in a more serious scenario, allow code execution. The CVE record identifies an out-of-bounds write and an unchecked return value. The fix makes the decoder reject the malformed input.
The report says Google Brotli versions 1.0.10, 1.1.1 and 1.2.1 contain fixes. It also lists patched releases for Node.js—22.23.4, 24.22.1 and 26.12.1—and Python’s Brotli 1.2.1 and brotlicffi 1.2.1.0. Other listed updates include Bun 1.4.4, several Envoy and Istio releases, .NET runtime releases 8.0.33, 9.0.22 and 10.0.14, and Debian package updates.
Updating a package may not be enough by itself: a running process continues using the decoder it loaded until it is restarted. The report says Node.js versions 20, 23 and 25 have no fix listed. It also reports that an independent tracker identified seven bundled copies still unfixed as of October 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. The status of each project can change as maintainers release updates.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Brotli’s Reach Matters
The issue matters because Brotli is not confined to a single application. It is used to compress web traffic, and the decoder can arrive indirectly through a runtime, package, system library or software project that includes its own copy. That creates a cross-stack patching problem: organizations need to identify which component actually supplies the decoder, rather than assume that updating one top-level framework resolves the risk.
Exposure depends on how software handles compressed data. The report points to clients that automatically decode Brotli responses, server-side parsers that inflate compressed request bodies, and tools that read compressed files. It says Express versions 5.0.0 through 5.3.0 and body-parser versions 2.0.0 through 2.3.0 can inflate Brotli request bodies when configured to do so, but stresses that the flaw is in Brotli, not Express. Updating Express alone would not fix an affected decoder.
The report cites an Imperva demonstration that ran code on an official Node.js image after several attempts. That is evidence of a demonstrated possibility, not evidence of attacks against users. It says Google’s CVE record assigns a CVSS 4.0 score of 9.2, rated Critical, while CISA data listed no exploitation and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time of publication. Those status details are time-sensitive.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
From Source Fix to Runtime Patches
The report traces the root-cause change to a Brotli source-code commit on February 27, 2026, titled “Detect and report invalid stream earlier.” It says the change did not identify a security issue at the time. Releases carrying the fix appeared on October 21, a gap the report calculates at 236 days. OpenAI said the security significance was not known when the change was made and that no newer Brotli release had been available.
The vulnerability became public on October 22, according to the report, which also says a public proof of concept appeared on GitHub that day. Patches then had to move through a chain of maintainers and distributors: from the underlying library to language runtimes, packages, operating-system distributions and container images. On October 23, the report says Python packages were not yet listed in an advisory database, leaving some dependency scanners without an alert; GitHub’s advisory was added later that day.
Node.js credits OpenAI Codex Security, and OpenAI says it found the flaw during red-teaming with teams of AI agents. That account describes how the issue was found, but the supplied material does not establish that AI tools discovered every affected copy or that all dependent projects have completed their reviews.
“A bigger deal than PHP2Shell.”
— Security researcher Juliano Rizzo, as quoted by the report
Remaining Unfixed Copies and Exposure
The available information does not establish that attackers are exploiting the flaw in the wild. The report says CISA data showed “exploitation: none” and that the CVE was not in the agency’s Known Exploited Vulnerabilities catalog as of October 26. Those indicators describe the status reported at that time; they do not prove that exploitation is impossible or settle whether activity could emerge later.
It is also not clear from the supplied material how many organizations have vulnerable systems exposed, how many of the reported bundled copies have since been patched, or whether every downstream package has identified its Brotli version. The Imperva demonstration is described as succeeding after several attempts, but the report does not provide enough detail to quantify how reliably the flaw can be exploited across different environments.
The report separately mentions DreamHost resetting some email and FTP/SFTP passwords after an incident. It names no cause, and the source explicitly says there is no known link to Brotli. The two developments should not be treated as related.
Patch, Restart and Check Dependencies
Organizations should identify where Brotli is used in their applications, runtimes, operating systems and bundled tools, then apply the vendor’s fixed release for each affected component. The report cautions that a bare Node.js HTTP server does not decode request bodies automatically, while built-in fetch can decode Brotli responses; actual exposure depends on the code paths and packages in use. Teams should not assume that a framework update replaces a vulnerable decoder.
After patching, teams need to restart affected processes so they load the corrected library. They should also check container images and system-library configurations, since some distributions build Node.js against a system Brotli library while official Node.js builds bundle their own copy. The report does not give a universal deadline or a single check that covers every project.
Maintainers are expected to keep publishing updates for bundled copies, and the vulnerability tracker may change as those releases arrive. The next practical milestone for users is confirming that their specific dependency and deployed runtime are on a fixed version—not merely that a patch exists somewhere in the software chain.
Key Questions
What is CVE-2026-111497?
It is a reported memory-corruption flaw in Google’s Brotli C decoder. The issue affects versions 1.0.3 through 1.2.0 and can be triggered by a crafted malformed compressed stream, according to the cited advisories.
Does updating Express fix the issue?
Not by itself. The report says the flaw is in the Brotli decoder rather than Express. Applications using Express or body-parser to inflate Brotli request bodies need the underlying decoder updated as well.
Which Node.js releases are listed as fixed?
The report lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. It says Node.js 20, 23 and 25 have no fix listed in the material available on October 26, 2026.
Is the flaw being exploited in the wild?
The supplied report says CISA data listed no exploitation and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also describes a code-execution demonstration by Imperva. A demonstration is not confirmation of real-world attacks.
Why must affected services be restarted?
A running process can keep using the decoder already loaded in memory after a package update. Restarting affected services allows them to load the patched version, according to the report.
Source: ThorstenMeyerAI.com
