Broccoli2Shell: Assess Compression Dependencies Across Your Stack

🔍 Read the full analysis: Broccoli2Shell: Assess Compression Dependencies Across Your Stack on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Broccoli2Shell, a flaw in Google’s Brotli decompression library tracked as CVE-2026-111497, has triggered security fixes across Node.js, Python packages and other software that includes the decoder. Imperva demonstrated code execution on an unmodified Node.js build, but CISA reports no known exploitation in the wild; organizations still need to check their dependencies because a single library is bundled into many different products.

The issue affects Google’s Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js advisory, malformed compressed input can be treated as incomplete rather than invalid. The decoder may then write beyond an eight-byte internal buffer, corrupting memory. The CVE record identifies an out-of-bounds write and an unchecked return value. Potential consequences include a crash, exposure of memory contents or, under some conditions, code execution.

Fixes are available in Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Updates have also been listed for Envoy, Istio, .NET and Debian releases. Node.js versions 20, 23 and 25 are listed as receiving no fix. The appropriate update depends on how a product obtains Brotli: official Node.js builds include their own copy, while some Linux distributions use a system library.

Updating files alone may not remove the vulnerable decoder from an already running service. The source material says affected processes must be restarted to load the patched version. It also reports that an independent tracker listed more than 30 projects and packages bundling their own copy, with seven bundled copies still unfixed as of October 26. These tracker counts are a snapshot, not a complete inventory of every deployment.

Why Brotli Reaches So Many Services

The exposure is not limited to applications that explicitly call a Brotli library. A runtime or framework may decode compressed data on an application’s behalf. For example, Node.js’s built-in fetch() automatically decodes Brotli responses, while Python HTTP clients may do so when a Brotli package is installed. Applications that accept compressed request bodies, fetch remote content, or process files can therefore inherit the affected decoder through a dependency.

This matters for both direct and indirect software dependencies. Upgrading a framework such as Express alone will not fix a flaw in the separate Brotli decoder it uses. Conversely, a service that does not accept compressed request bodies might still encounter the library when fetching a response or processing a file. Teams need to trace which decoder their actual build uses, patch the relevant component, and restart processes rather than relying only on a top-level package list.

The available evidence supports serious potential impact, not a claim of active attacks. Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0, and Imperva reported a code-execution demonstration after several attempts. CISA’s data says exploitation is “none,” and the vulnerability is not listed in its Known Exploited Vulnerabilities catalog. Those details distinguish demonstrated exploitability from confirmed use against victims.

From February Fix to October Alerts

The repair was committed to the Brotli source on February 27, 2026, under the title “Detect and report invalid stream earlier.” The source material says the commit did not identify the change as security-related. Releases carrying the fix appeared on October 21, a gap of 236 days. OpenAI said the vulnerability was not known at the time of the commit and that no newer Brotli release had been available.

The CVE became public on October 22, alongside a public proof of concept, according to the cited tracker. From there, fixes had to reach projects that bundle or depend on Brotli, then package repositories, distributions and deployed processes. The source reports that Python packages were missing from an advisory database on October 23, leaving dependency scanners without an alert until GitHub’s advisory was added later that day.

Node.js credits OpenAI Codex Security, and OpenAI said the flaw was found during red-teaming with teams of AI agents. The source also notes that Juliano Rizzo described the issue as “a bigger deal than PHP2Shell.” These are attributed assessments, not evidence that the flaw has been exploited. The separate DreamHost password-reset incident mentioned in the source has no stated cause and is not linked to Broccoli2Shell.

Unfixed Copies and Exposure Paths

Not every bundled copy has a fix. The cited tracker listed seven still-unfixed projects as of October 26, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. Five other projects were reported to have fixes in their main branches, which does not by itself establish that those changes have reached released packages or deployed systems.

The source does not establish how many services are vulnerable, whether attackers have used the flaw, or which specific installations are exposed. CISA reports no known exploitation, but that status cannot rule out activity that has not been detected or reported. Exposure also depends on whether the affected decoder is present and whether an application processes attacker-controlled compressed data. The source gives no complete inventory of systems using affected versions.

Patch, Restart and Verify

Organizations should check runtime versions, direct and transitive dependencies, operating-system packages, container images and software that bundles Brotli independently. They should apply the update listed for the component actually in use, then restart affected services so running processes load the fixed decoder. A framework-only update may not be sufficient if the vulnerable library remains in the build.

Teams should also recheck vendor advisories and package trackers for projects that had not released fixes as of October 26. The next meaningful milestones are those releases, distribution updates and confirmation that patched images have been deployed. Until those checks are complete, the number of affected installations and the status of several bundled copies remain open questions.

Key Questions

What is Broccoli2Shell?

It is the name used for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. Malformed compressed input can cause an out-of-bounds write.

Has the vulnerability been exploited in the wild?

The source reports that CISA lists exploitation as none and that the CVE is not in its Known Exploited Vulnerabilities catalog. Imperva demonstrated code execution in a test on an unmodified Node.js build; that is not confirmation of attacks against real systems.

Which software has fixes?

Listed fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and updates for Bun, Envoy, Istio, .NET and Debian. Check the advisory for the exact component and release used in your environment.

Is upgrading a package enough?

Not always. Some products bundle their own Brotli copy, and a running process can continue using its already-loaded decoder. Apply the relevant fix and restart affected processes; verify that deployed builds use the patched component.

Source: ThorstenMeyerAI.com