Why Broccoli2Shell Matters Across Node.js, Python, And Beyond

🔍 Read the full analysis: Why Broccoli2Shell Matters Across Node.js, Python, And Beyond on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security fixes for CVE-2026-111497, a flaw in Google’s Brotli compression decoder, are now available across Node.js, Python packages and other software, but some projects that bundle their own decoder copy remain unpatched. The vulnerability can cause an out-of-bounds memory write when software processes crafted compressed data, putting applications that decode Brotli content at risk of crashes, memory exposure or, in severe cases, code execution.

The affected C decoder versions are listed as 1.0.3 through 1.2.0. According to the Node.js advisory, the decoder mishandled malformed input that it treated as incomplete, allowing data to be written beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. The patched decoder instead stops with a format error.

Fixes listed in the source material include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Updates are also listed for Envoy, Istio, .NET and Debian. Node.js 20, 23 and 25 are identified as receiving no fix.

Updating software may not be enough for already-running services: the source says a process retains its existing decoder until it is restarted. An independent tracker listed seven bundled copies still unfixed as of Oct. 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. Five other projects had fixes in their main development branches, according to the same tracker.

One Decoder, Many Software Stacks

Brotli is used to compress and decompress data across web services and software tools. Because the flaw is in a shared decoder rather than in a single application, the affected footprint can include multiple languages and deployment layers. Software may use the decoder through a package, bundle its own copy, or rely on a runtime or operating-system build.

Exposure depends on what a system does with compressed input. The source identifies automatically decoded web responses, accepted Brotli-compressed request bodies and files processed by tools as potential routes. For example, Node.js’s built-in fetch can decode Brotli responses, while some Python HTTP clients do so when a Brotli package is installed. Express and body-parser versions listed in the source can inflate Brotli request bodies, but the issue is in the decoder: upgrading Express alone does not fix it.

This layered supply chain affects both patching and risk assessment. A team must identify the actual decoder in use, update the relevant runtime or package, and restart processes. A scanner that checks only direct dependencies may miss a decoder copied into another project. The source reports that seven bundled copies remained unfixed on Oct. 26, making inventory and vendor updates part of the response rather than a one-time package upgrade.

From February Fix to October Alerts

The source traces the underlying code change to Feb. 27, 2026, when a Brotli commit titled “Detect and report invalid stream earlier” addressed the behavior. The change did not identify a security vulnerability, according to the source. Releases carrying the fix appeared on Oct. 21, a gap of 236 days.

The CVE became public on Oct. 22, according to the source, and a public proof of concept appeared on GitHub that day. On Oct. 23, OpenSourceMalware reported that no advisory database then listed the Python packages, leaving dependency scanners without those entries; GitHub’s advisory added them later that day. These dates help explain why fixes have to move through a chain of upstream libraries, language runtimes, packages, distributions, container images and running services.

The source describes this as part of a wider pattern in which a small shared parsing library can affect software written in different languages. It also says Node.js credited OpenAI Codex Security, and OpenAI said the flaw was found during red-teaming with teams of AI agents. Those statements describe the discovery process; they do not change which products require updates.

““A bigger deal than PHP2Shell””

— Juliano Rizzo, security researcher, as quoted by broccoli2shell.com

Exposure and Exploitation Status

The available information does not establish how many systems remain vulnerable or whether attackers have used the flaw outside demonstrations. The source says CISA data listed “exploitation: none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of Oct. 26. That status does not rule out future exploitation.

Imperva reportedly ran code on an official Node.js image after several attempts, but the source does not provide enough technical detail to assess the conditions needed to reproduce that result. The affected bundled copies may also change as maintainers issue releases. Teams will need to verify their own dependency trees and the specific builds deployed; a general product name may not reveal whether the system uses a patched bundled decoder or an affected system library.

Patch Releases and Restarts

Operators should check the version of Brotli used by each runtime, package, operating-system build and bundled tool, then apply the matching vendor fix. For Node.js, the source lists patched releases 22.23.4, 24.22.1 and 26.12.1; Node.js 20, 23 and 25 are listed without fixes. Python users should check both Brotli and brotlicffi dependencies. Where a project bundles Brotli, its own advisory or release may be needed.

After updating, teams should restart affected processes so they load the patched decoder, and rebuild or redeploy images that contain old copies. They should also monitor advisories for the seven projects the tracker still listed as unfixed on Oct. 26. The source does not give a final date for those updates, so the patch status remains developing.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for the vulnerability in Google’s Brotli decoder tracked as CVE-2026-111497. The source says malformed compressed input can cause an out-of-bounds write, with possible effects including a crash, memory exposure or, in severe cases, code execution.

Which Node.js versions have fixes?

The source lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. It says Node.js 20, 23 and 25 do not receive a fix. Check the applicable Node.js security advisory for current release details.

Does upgrading Express fix the issue?

No, not by itself. The source says the vulnerability is in Brotli, not Express. Some Express and body-parser versions inflate Brotli request bodies, but the decoder package or runtime providing Brotli must be patched as well.

Is the flaw being exploited in the wild?

The cited source reports no known exploitation in the wild: CISA data listed “exploitation: none,” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of Oct. 26, 2026. That is a status report, not a guarantee that exploitation will not occur.

Why must services be restarted after patching?

A running process continues using the decoder already loaded into memory, according to the source. Restarting after the update allows the service to load the patched version; container images and other deployed copies may also need rebuilding or redeployment.

Source: ThorstenMeyerAI.com