What To Do About Broccoli2Shell In Node.js, Python, And Other Platforms

🔍 Read the full analysis: What To Do About Broccoli2Shell In Node.js, Python, And Other Platforms on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Security fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are now available across several runtimes and packages, including Node.js and Python. The issue can affect applications that decode attacker-supplied Brotli data; administrators must update the relevant component and restart processes to load the fix.

The flaw affects Brotli C decoder versions 1.0.3 through 1.2.0. The Node.js advisory describes malformed compressed input that the decoder treated as incomplete rather than invalid. That handling could cause an out-of-bounds write, potentially crashing a process or corrupting memory. Code execution is a possible worst-case impact, but it is not the same as evidence of widespread exploitation.

Available fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; and Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The supplied advisory list also names Bun 1.4.4, several Envoy and Istio releases, and .NET runtime releases. These version numbers are specific to the affected product: teams should check the relevant project’s advisory and distribution package status before choosing an upgrade.

Updating alone may not clear a live process. The source material says a running process continues using its existing decoder until restarted. Official Node.js builds include their own Brotli copy, so those deployments need a fixed Node.js release. Other installations may link to a system library, making the operating-system package relevant too.

A Shared Decoder Spreads Exposure

Brotli is used to compress web content, so the same underlying decoder can appear in many products. Affected paths include automatically decoded responses fetched by applications, Brotli-compressed request bodies accepted by some parsers, and files processed by tools that use the C library. Exposure depends on whether a product actually uses a vulnerable copy and processes data an attacker can control; the mere presence of Brotli does not prove that a particular service is exploitable.

The cross-platform reach makes inventory work as important as patching. The source material cites an independent tracker listing more than 30 projects and packages that bundle their own copy, while some copies had not yet received a fix as of October 26. A patch in the upstream library does not automatically update a runtime, container image, operating-system package or application dependency. Teams need to identify where the decoder comes from and confirm the fix reached the deployed artifact.

The advisory assigns the issue a CVSS 4.0 score of 9.2, rated Critical. At the same time, the source reports no known exploitation in the wild: CISA’s data lists exploitation as “none,” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the report date. Those points describe the reported status then; they do not remove the need to patch.

From Upstream Fix to Runtime Patches

The source says the Brotli correction entered the project source on February 27, 2026, under a commit titled “Detect and report invalid stream earlier.” It was not described as a security fix at the time. Releases containing the correction appeared on October 21, a gap the source calculates as 236 days. The CVE became public on October 22, alongside a public proof of concept, according to the cited tracker.

That timeline helps explain why multiple projects required separate updates. A decoder can be bundled directly into a runtime or package, or supplied by a system library. Node.js released patched versions, while Python packages and other ecosystem projects published their own fixes. The source also reports that Debian listed patched packages for bookworm and trixie, with distribution-specific version strings; users should follow their distribution’s security notices rather than assume an upstream version number maps directly.

Some project versions named in the source have no listed Node.js fix: Node.js 20, 23 and 25. The source further says that, as of October 26, seven bundled copies were still unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools. It says five other projects had fixes in their main branches, which may not yet mean a released update is available.

Unpatched Copies and Exposure Status

Exposure varies by deployment. The available information does not establish that every application using Node.js, Python, Brotli or a listed framework is vulnerable. The relevant questions are which decoder copy is loaded, whether the affected code path is used, and whether untrusted compressed input can reach it.

The source’s list of unfixed bundled copies is a snapshot dated October 26, 2026, and may change as maintainers publish releases. It does not provide a complete, verified inventory of every affected downstream product. It also reports no known in-the-wild exploitation at that time, but that status could change; the Imperva demonstration of code execution on an official Node.js image shows a demonstrated possibility, not confirmed attacks against deployed services.

The source mentions a separate DreamHost password-reset incident but says the company named no cause and provides no evidence linking it to Broccoli2Shell. The incidents should not be treated as connected.

Patch, Restart, Then Verify

Teams should check the advisories for their runtime, package manager, operating system, proxy and bundled tools; apply a fixed release where one is available; and restart affected processes. For Node.js services, first confirm whether the installation is an official build with bundled Brotli or a system-linked build. Python users should check both the Brotli or brotlicffi package and the applications that load them.

Where a direct fix has not been released, maintainers’ advisories and distribution notices are the next source of status. Organizations can reduce uncertainty by identifying components that accept compressed request bodies, fetch Brotli responses, or decode files from untrusted sources, then verifying the actual library version in deployed images. The next development to watch is whether the remaining bundled copies receive released patches and whether security agencies update their exploitation assessments.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the nickname used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. Malformed compressed input can trigger an out-of-bounds write in affected versions.

Which Node.js versions include the fix?

The source lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. It says Node.js 20, 23 and 25 have no fix listed; check current Node.js security guidance for the status of your release line.

Does upgrading Express fix the issue?

Not by itself, according to the source. The flaw is in Brotli, not Express. Some Express and body-parser versions can inflate Brotli request bodies, so applications using that path need a fixed decoder or runtime as well as any framework updates their maintainers recommend.

Are attackers exploiting the flaw in the wild?

The source reports no known in-the-wild exploitation as of October 26, 2026. CISA’s data listed exploitation as “none,” and the CVE was not in its Known Exploited Vulnerabilities catalog at that time. An independent demonstration of code execution was reported, but that does not establish active attacks.

What should teams do after installing a patch?

Restart affected processes so they load the updated decoder, then verify the version in the deployed runtime, package or system library. Check containers and bundled tools separately, since updating one component may not update every copy.

Source: ThorstenMeyerAI.com