🔍 Read the full analysis: Node.js And Python Face The Broccoli2Shell Compression Bug: Next Steps on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A memory-corruption flaw in Google’s Brotli decoder, CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and carries into Node.js, Python packages and other software that bundles the library. Fixes are available for several current releases, but affected services need to be updated and restarted; the source reports no known exploitation in the wild.
Security fixes are now available for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder that affects versions 1.0.3 through 1.2.0 and can reach applications through bundled copies of the library. The issue has patches for current Node.js and Python releases, among other projects, but the source report says exploitation in the wild has not been reported and warns that running processes must be restarted to load updated code.
The flaw occurs when the decoder handles a malformed compressed stream as if it were incomplete input. According to the Node.js advisory, that behavior can cause the decoder to write beyond an eight-byte internal buffer. The resulting memory corruption could crash a process or expose memory; code execution is a potential worst-case outcome, not a confirmed result for every affected application.
The source report says Imperva demonstrated code execution on an official Node.js image after several attempts. Google’s CVE record assigns the issue a CVSS 4.0 score of 9.2, rated Critical. The report also says CISA data lists exploitation as “none” and that the CVE is absent from CISA’s Known Exploited Vulnerabilities catalog. Those statements describe the status reported as of October 26, 2026.
Listed fixes include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; and Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The report also lists updates for Bun, Envoy, Istio, .NET and Debian. Node.js 20, 23 and 25 are identified as receiving no fix, so users of those versions should consult the relevant project guidance for a supported upgrade path.
Infographic 01 · Where Brotli decoding meets untrusted input
One decoder, many doors.
The flaw sits in Google's Brotli C decoder. Every runtime, package and tool that copies it inherits the bug. Three paths bring attacker data to it.
Responses your code fetches
no WAF sees these
- Node.js
fetch()decodes Brotli automatically - Python
requests,urllib3,aiohttp,httpx[brotli], Scrapy, once a Brotli package is installed - Webhooks, link previews, crawlers, “import from URL”
Request bodies you accept
WAF can block br bodies
- Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli bodies (
json(),raw()) - Upgrading Express alone does not help: the bug is in the runtime
- A bare Node.js HTTP server does not decode bodies on its own
Files you open or process
not only HTTP
- Archives and
.brfiles (7-Zip-zstd, p7zip) - Parquet data files (DuckDB, Apache Arrow bundled build)
- Fonts (woff2), firmware tools (EDK II), JPEG XL via libjxl
Fixed versions
patch, then restart a running process keeps the old decoder
| Component | Fixed in | Note |
|---|---|---|
| Google Brotli (C library) | 1.0.10 · 1.1.1 · 1.2.1 | 1.0.3–1.2.0 |
| Node.js | 22.23.4 · 24.22.1 · 26.12.1 | 20, 23, 25: no fix (end of life) |
Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 | 1.0.3 up to 1.2.0.x |
| Bun | 1.4.4 | includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 | if Brotli decompression is configured |
| Istio | 1.29.9 · 1.30.6 · 1.31.2 | 1.29 is end of life |
| .NET runtime | 8.0.33 · 9.0.22 · 10.0.14 | GitHub source builds still affected |
Debian brotli | bookworm 1.0.9-2+deb12u1 · trixie 1.1.0-2+deb13u1 | DLA 4855-1 · DSA-6582-1 |
Official Node.js builds bundle their own Brotli, so only the Node.js version matters there; some distributions (Debian, Ubuntu 22.04+) build Node.js against the system library instead.
Sources: CVE record (Google CNA, CISA ADP 23 Oct); Node.js (21 Oct 2026); GHSA-9v8h-qqgm-4m35; Brotli releases (21 Oct 2026); Patch the Planet (23 Oct 2026); Imperva (22 Oct 2026); broccoli2shell.com (26 Oct 2026); OpenSourceMalware (23 Oct 2026); Debian tracker; pypistats.org (26 Oct 2026).
Powered by Thorsten Meyer AI
Why Bundled Brotli Expands Exposure
The reach of the flaw depends on where Brotli decoding happens, not just on whether a team directly installed the C library. Node.js, Python packages and other runtimes may carry their own copy, while frameworks or applications can invoke decoding behind familiar features. Updating a top-level framework alone may leave the vulnerable decoder in place.
Potential exposure paths include fetching compressed responses, accepting compressed request bodies, and processing files such as archives or data files. The report says Node’s built-in fetch() automatically decodes Brotli responses; Python clients can do so when a Brotli package is installed. It also names certain Express and body-parser versions that inflate Brotli request bodies. A bare Node.js HTTP server, by contrast, does not decode request bodies automatically, according to the source.
For operators, the practical issue is a chain of dependencies: a fix must reach the library or runtime, then any package, distribution or container image, and finally the active process. Restarting matters because an already-running service continues using the decoder loaded in memory. The report says Python’s Brotli package had about 83 million downloads in the month checked on October 26, citing pypistats.org; that is a download count, not a measure of vulnerable installations.
Popular right now
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
Shark Rocket Pet Plus Corded Stick Vacuum, Bordeaux, HV322
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
As an affiliate, we earn on qualifying purchases.
A Patch Took Months to Spread
The source report traces the underlying code change to February 27, 2026, when Brotli’s source repository received a fix titled “Detect and report invalid stream earlier.” The report says the commit did not identify the change as security-related. Releases containing the fix appeared on October 21, a 236-day interval cited by the report.
OpenAI said the earlier change was not known at the time to represent a security vulnerability and that Brotli had not had a more recent release. The report says the CVE became public on October 22, the same day a public proof of concept appeared on GitHub. It describes patches then moving through downstream projects and package channels; on October 23, a tracker cited by the report said Python packages were missing from advisory databases before GitHub’s advisory was added later that day.
The issue has also been reported as an example of AI-assisted security review. Node.js credits OpenAI Codex Security, while OpenAI said it found the flaw during red-teaming with teams of AI agents. The source also cites security researcher Juliano Rizzo comparing the breadth of the issue to “zlib 20 years ago.” These are attributed assessments, not evidence that every affected product is exploitable in the same way.
““A bigger deal than PHP2Shell” and “zlib 20 years ago.””
— Juliano Rizzo, according to broccoli2shell.com as cited in the report
Exploit Activity and Unpatched Copies
The source report says there was no known exploitation in the wild as of October 26, while also describing a researcher demonstration of code execution on an official Node.js image. A controlled demonstration establishes a possible impact under those conditions; it does not establish that attackers have used the flaw against real systems. The report does not give details sufficient to assess how reliably the demonstration applies to other configurations.
Patch coverage is also incomplete. According to the tracker cited in the report, seven bundled copies remained unfixed as of October 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; five more had fixes in their main branches. The report does not specify release dates for every outstanding project, and tracker status can change after publication.
Teams may not know whether they are exposed simply by checking their direct dependency list: software can bundle Brotli internally, and some Linux distributions build against a system library. The source notes this distinction for Node.js distributions. It also does not establish that every application accepting compressed data enables Brotli decoding or is reachable by an attacker.
Update, Rebuild and Restart Services
Operators should identify which runtime, package, distribution and image versions their applications actually use, then apply the fixed release appropriate to each component. The source lists Node.js 22.23.4, 24.22.1 and 26.12.1, plus Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Teams should check the vendor advisory for their exact platform, especially when using a system-provided or bundled copy rather than installing Brotli directly.
After updating dependencies or rebuilding images, teams should restart affected processes and confirm that the deployed artifact contains the patched decoder. They should check applications that fetch compressed content, accept compressed bodies, or process files with Brotli support, while avoiding assumptions that a framework upgrade alone fixes a separate bundled library.
Project maintainers still need to publish or confirm fixes for outstanding bundled copies, and advisories may be added as package and distribution status changes. The report identifies no confirmed exploitation campaign or single deadline for remaining updates. The next useful milestones are therefore project-specific releases and verification that patched code has reached production.
Key Questions
What is CVE-2026-111497?
It is a flaw in Google’s Brotli decoder, reported for versions 1.0.3 through 1.2.0. Malformed compressed input can trigger an out-of-bounds write and memory corruption.
Does the flaw affect every Node.js or Python application?
No. Exposure depends on the version and how the application uses Brotli. The report identifies affected Node.js and Python releases and says applications may encounter the decoder through dependencies or bundled copies; it does not say every application is reachable or vulnerable in the same way.
Which versions does the report list as fixed?
It lists Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1; and brotlicffi 1.2.1.0. It also names fixes for Bun, Envoy, Istio, .NET and Debian. Check each project’s current advisory for platform-specific instructions.
Is the vulnerability being exploited in the wild?
The source report, dated October 26, 2026, says CISA data listed exploitation as “none” and reports no known in-the-wild exploitation. It separately describes a code-execution demonstration on an official Node.js image; that is not the same as a confirmed attack campaign.
Is upgrading enough, or do services need to restart?
The report says a running process retains the decoder it already loaded. After applying the fix and rebuilding or updating the deployed application, restart affected processes and verify the running version.
Source: ThorstenMeyerAI.com
