Broccoli2Shell Explained: A Compression Bug Across Multiple Ecosystems

🔍 Read the full analysis: Broccoli2Shell Explained: A Compression Bug Across Multiple Ecosystems on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Security fixes are spreading across Node.js, Python, Bun, Envoy, Istio and .NET for Broccoli2Shell, a flaw in Google’s Brotli decoder that can corrupt memory when processing crafted compressed data. The CVE record rates the vulnerability 9.2, Critical, under CVSS 4.0; the cited CISA data reports no known exploitation, while at least seven tracked projects with bundled decoder copies remained unfixed as of October 26, 2026.

The vulnerability, tracked as CVE-2026-111497, affects Google’s Brotli C decoder versions 1.0.3 through 1.2.0, according to the source material. The Node.js advisory describes a decoder that treated malformed input as if it were incomplete, allowing data to be written beyond an eight-byte internal buffer. The flaw is listed as an out-of-bounds write and an unchecked return value. Memory corruption can crash a process or expose memory; code execution is a possible worst-case outcome, not an outcome established for every affected installation.

Imperva demonstrated code execution against an official Node.js image after several attempts, according to the source. That is a reported demonstration, not evidence of attacks in the wild. CISA’s exploitation data was listed as “none,” and the vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog as of the source’s October 26 reporting date.

Fixes listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and specified releases of Envoy, Istio and .NET. Node.js 20, 23 and 25 were listed as receiving no fix. A restart is needed after updating because running processes continue using the decoder already loaded into memory.

Why Brotli’s Reach Expands Exposure

Brotli is used to compress web traffic, but the decoder also arrives inside software that developers and operators may not identify as a direct Brotli dependency. Node.js fetch, Python HTTP clients, proxy software and file-processing tools can all bring the library into a system. This means exposure depends not only on the main application’s version but also on which decoder it uses and whether that component processes attacker-controlled compressed data.

The source identifies three broad paths: responses an application fetches and automatically decompresses, compressed request bodies accepted by software, and files handled by tools using Brotli. Express’s body parsers are cited as one example of a component that can inflate Brotli request bodies, but the source stresses that the bug is in Brotli, not Express; upgrading Express alone does not fix a vulnerable decoder. A bare Node.js HTTP server also does not automatically decode request bodies.

The practical consequence is a supply-chain patching task. Teams may need to update a runtime, package, operating-system library or container image, then restart services. The source says Python’s Brotli package had about 83 million downloads in the previous month, according to pypistats.org checked October 26. That is a raw download count, not a measure of vulnerable installations or active exposure.

From February Fix to October Patches

The source traces the underlying code change to February 27, 2026, when a Brotli source commit titled “Detect and report invalid stream earlier” addressed the behavior. It says the commit did not identify the change as security-related. Releases carrying the fix appeared on October 21, a 236-day gap before the patched versions were released, according to the source’s timeline.

The CVE became public on October 22, and a public proof of concept appeared on GitHub that day, the source reports. Patches then had to reach projects that bundle Brotli, as well as operating-system packages and deployed images. On October 23, the source says, Python packages were missing from advisory databases before GitHub’s advisory was added later that day. As of October 26, its tracker listed seven bundled copies still unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools; it said five more had fixes in their main branches.

The source also reports that Node.js credited OpenAI Codex Security, and that OpenAI said the flaw was found during red-teaming with teams of AI agents. These are attributed descriptions of the discovery process, not evidence that AI tools alone found or confirmed every downstream instance.

Exposure and Exploitation Still Vary

The available information does not establish how many systems are vulnerable, how many have been patched, or whether attackers have exploited the flaw. The cited CISA data reported no exploitation as of the source’s reporting date, but that status does not prove that no unreported attacks occurred. Imperva’s code-execution demonstration shows a possible impact in a test setting; it does not establish that the same result applies to every runtime or deployment.

It also remains unclear when each of the seven tracked bundled copies still listed as unfixed will receive a release. A fix in a project’s main branch may not yet be available in a stable package or in deployed systems. The source does not provide a complete inventory of affected hosts, nor does it confirm that every application using Brotli processes untrusted compressed input.

The source separately mentions DreamHost resetting some email and FTP/SFTP passwords after an incident. It says DreamHost named no cause and that nothing links that incident to Brotli; the two developments should not be treated as connected.

Patch Releases and Restart Checks

Organizations should identify which Brotli implementation their software uses, apply the appropriate vendor or distribution update, and restart affected processes so they load the patched decoder. Teams should check direct dependencies as well as runtimes, proxies, containers and tools that may bundle their own copy. For Node.js installations, the source lists fixed releases for versions 22, 24 and 26, but no fix for versions 20, 23 and 25; operators should consult current project guidance for supported upgrade paths.

The near-term signal to watch is whether the remaining bundled projects publish stable fixes and whether Linux distributions and downstream images incorporate them. The tracker and advisories can change after the source’s October 26, 2026 snapshot, so the listed patch status should be checked against current vendor notices before action. No further milestone or deadline is specified in the source.

Key Questions

What is Broccoli2Shell?

It is the name used for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The source says malformed compressed input can lead to an out-of-bounds write.

Does the flaw affect every Brotli user?

No universal exposure is established. The source lists affected decoder versions and multiple downstream projects, but actual risk depends on the implementation in use and whether software processes crafted compressed data.

Which versions have fixes?

The source lists Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; plus fixes for Bun, Envoy, Istio and .NET. Check the relevant vendor advisory for the version used in your environment.

Is Broccoli2Shell being exploited in the wild?

The cited CISA data reported “exploitation: none” as of October 26, 2026, and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog. The source does not establish whether any unreported exploitation has occurred.

Is upgrading enough, or must services restart?

The source says a restart is required because a running process continues to use the decoder loaded before the update. Apply the relevant patch and restart affected services.

Source: ThorstenMeyerAI.com