Broccoli2Shell In Production: What To Update, Restart, And Inspect

🔍 Read the full analysis: Broccoli2Shell In Production: What To Update, Restart, And Inspect on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security updates are spreading for Broccoli2Shell, a flaw in Google’s Brotli decoder tracked as CVE-2026-111497, after researchers demonstrated code execution on an unmodified Node.js build. The vulnerability affects Brotli versions 1.0.3 through 1.2.0 and can reach applications through runtimes and packages that include the decoder, making patching and restarting affected services the immediate response.

The flaw is in the Brotli C decoder, not in Node.js or Express itself. The Node.js advisory describes malformed compressed input that the decoder treated as incomplete rather than invalid; the decoder could then write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on the affected program and how it handles the data, memory corruption can cause a crash, expose memory or potentially enable code execution.

Fixes listed in the source material include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. The material also lists patched releases for Envoy, Istio, .NET and Debian. Administrators should match the upgrade to the component actually deployed: an application package update may not replace a decoder bundled inside a runtime or tool.

Restarting matters because a process that is already running continues to use the decoder loaded when it started. Apply the relevant patched release, rebuild or redeploy affected images where needed, and restart the service or workload. The source material says Node.js 20, 23 and 25 have no listed fix, and its tracker reported seven bundled copies still without fixes as of October 26. Those tracker findings are time-sensitive and should be checked against current vendor advisories.

Why Shared Brotli Copies Matter

Brotli is used to compress web responses and other data, so a flaw in the shared decoder can affect more than one language or product. Exposure depends on whether a particular application processes attacker-controlled Brotli data. Examples cited in the source include fetching compressed responses, accepting compressed request bodies, and tools that read files such as archives or data files. A dependency’s presence alone does not establish that an installation is exploitable.

The update workload can extend beyond a single package: maintainers may need to patch a library, publish a runtime or package update, rebuild a container image, and then restart running services. The source reports that an independent tracker listed more than 30 projects and packages bundling their own copy, while some copies remained unfixed. That makes inventorying deployed components important, especially where software ships a private decoder rather than using the system library.

The cited evidence indicates a serious vulnerability, but not confirmed widespread exploitation. Google’s CVE record assigns a CVSS 4.0 score of 9.2, Critical. The source says CISA data listed exploitation as none and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time of publication. Those indicators describe the reported status, not a guarantee that exploitation cannot occur.

From Decoder Fix to Runtime Patches

The root-cause change was committed to Brotli’s source code on February 27, 2026, under the title “Detect and report invalid stream earlier.” According to the source, that commit did not describe the change as a security fix. Releases containing the fix appeared on October 21, a gap of 236 days. The vulnerability became public on October 22, when a proof of concept also appeared on GitHub, according to the source’s cited tracker.

That delay helps explain why a library-level correction did not immediately protect every dependent application. Each project that bundles or depends on Brotli must identify the issue, produce a release, and distribute it. The source reports that Python package advisories were absent from some advisory databases on October 23 before GitHub’s advisory was added later that day. Dependency scanning may therefore miss an issue until relevant package records are published.

For Node.js, the listed fixed releases are 22.23.4, 24.22.1 and 26.12.1; official builds bundle Brotli, while some Linux distributions may link Node.js against a system library instead. Python applications can use Brotli through packages such as Brotli or brotlicffi and through higher-level clients when the relevant support is installed. An upgrade to a framework alone may not fix a vulnerable decoder underneath it.

Exposure and Unpatched Copies

The source says Imperva demonstrated code execution after several attempts on an official Node.js image, but that demonstration does not show that every vulnerable deployment can be exploited in the same way. The conditions needed for exploitation will vary with the application, decoder build and whether untrusted compressed data reaches it. The material does not provide a complete, independently verified list of affected deployed systems.

It also reports that seven bundled copies remained without fixes as of October 26, naming DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools among them. Five additional projects reportedly had fixes in their main branches, which may not mean a stable release is available. Administrators should confirm status with each project’s current security notice rather than assume a tracker entry applies to their installed version.

No in-the-wild exploitation was listed in the CISA data cited by the source, and the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog at that time. Whether attackers are attempting exploitation outside those records, and whether additional vendors will publish advisories, remains unclear.

Patch, Redeploy and Verify

Teams should identify which applications process Brotli-compressed responses, request bodies or files, then check the versions of runtimes, packages, system libraries and bundled tools in use. Upgrade to a listed fixed release where one exists. For software without a released fix, follow the maintainer’s security notices and assess whether the affected decoding path can receive untrusted data.

After updating, restart affected processes and redeploy rebuilt images or workloads so they load the patched decoder. Verify the running version rather than relying only on a changed dependency file or a successful build. Organizations using distributions or software with bundled copies should check their vendor’s advisory, since the correct fix may differ from the upstream library version.

Further vendor updates and tracker changes are expected as remaining projects assess their copies. The status described here is based on information reported through October 26, 2026; patch availability and exploitation reporting may change after that date.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. The source reports that malformed compressed data can cause an out-of-bounds write and that code execution was demonstrated on an unmodified Node.js build.

Which versions are listed as fixed?

The source lists Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0, and Bun 1.4.4. It also gives patched versions for Envoy, Istio, .NET and Debian. Check the relevant vendor advisory for the product and version you run.

Why must affected services be restarted?

A running process generally continues using the decoder loaded when it started. Restarting or redeploying after the update loads the patched component into the running service.

Is Broccoli2Shell being exploited in the wild?

The source reports that CISA’s data listed exploitation as none and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. That is the reported status at that time and does not establish that exploitation is impossible.

Source: ThorstenMeyerAI.com