Broccoli2Shell By The Numbers: Three Steps For A Cross-Stack Bug

🔍 Read the full analysis: Broccoli2Shell By The Numbers: Three Steps For A Cross-Stack Bug on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security fixes are spreading for CVE-2026-111497, a flaw in Google’s Brotli decoder that can corrupt memory when it processes crafted compressed data. Imperva reported that it ran code on an unmodified Node.js build in a demonstration, while the supplied source says there is no known exploitation in the wild; the issue matters because Brotli is included in multiple runtimes, packages and other software.

The flaw affects Google’s Brotli C decoder versions 1.0.3 through 1.2.0. According to the Node.js advisory summarized in the source, malformed input could be treated as though the decoder needed more data, leading it to write beyond an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Memory corruption can cause a crash or expose data, and in some circumstances can enable code execution.

Fixes are available in Brotli 1.0.10, 1.1.1 and 1.2.1, and in Node.js 22.23.4, 24.22.1 and 26.12.1. Python’s Brotli package has a fix in 1.2.1, and brotlicffi in 1.2.1.0. The source also lists patches for Bun, Envoy, Istio, .NET and Debian releases. These versions and package details should be checked against each project’s advisories before deployment.

Updating a package does not replace the decoder already loaded by a running service: processes must be restarted to use the patched code. Node.js versions 20, 23 and 25 are listed as receiving no fix. Teams using those versions need to check their support options and upgrade paths rather than assume a patch will arrive for their current release.

How One Decoder Reaches Many Systems

The risk crosses language and product boundaries because projects may use Brotli through a package, a system library or a copy bundled inside a runtime. The source names Node.js, Python packages, Bun, Envoy, Istio and .NET among affected or patched components, and says an independent tracker lists more than 30 projects and packages that bundle their own copy. A fix in one project does not automatically update the others.

Exposure depends on what an application does with compressed data. The source describes potential entry points including automatically decoded web responses, accepted Brotli-compressed request bodies and files processed by tools such as archive or firmware utilities. That does not mean every application using a listed runtime is remotely exploitable: teams must determine whether the affected decoder is present and whether untrusted compressed data reaches it. The source reports Google’s CVE record gives the flaw a CVSS 4.0 score of 9.2, rated Critical; that rating describes severity, not evidence of attacks in the wild.

The operational challenge is the chain from a library fix through language runtimes, distributions, containers and deployed processes. The source says Python’s Brotli package had about 83 million downloads in the month before October 26, citing pypistats.org. That is a download count for that package and period, not a count of vulnerable installations or exposed services.

From February Fix to October Disclosure

The source says the underlying code change was committed to Brotli on February 27, 2026, under the title “Detect and report invalid stream earlier.” It says the commit did not identify the change as security-related. OpenAI later stated on X that the vulnerability was not known at the time and that no newer Brotli release was available. The fixed releases appeared on October 21, making the interval between the source-code change and those releases 236 days, according to the source.

The CVE became public on October 22, and the source says a public proof of concept appeared on GitHub that day. It also reports that the Node.js release on October 21 included the Brotli issue among multiple security fixes, and that Python package advisories followed. By October 26, the tracker cited by the source still listed seven bundled copies as unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; five others were reportedly fixed in their main branches. These tracker counts are a snapshot, not a complete inventory of every deployment.

Exposure and Remaining Unpatched Copies

The source reports no exploitation in the wild: CISA data listed exploitation as “none,” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of the article’s October 26 snapshot. Those details do not prove that no attack has occurred; they describe the available reporting and catalog status at that time. The source also says Imperva ran code in a demonstration after several attempts, which is evidence of a demonstrated exploit scenario, not evidence of real-world use.

The full set of affected deployments remains unclear. Some products bundle Brotli independently, while others rely on a system library, and the source notes that Linux distribution packaging can change which copy Node.js uses. The tracker’s seven unfixed copies were reported as of October 26 and may have changed since. It is also not clear from the supplied material which organizations have applied patches, restarted services or confirmed their exposure.

A separate item in the source says DreamHost was resetting some email and FTP/SFTP passwords after an incident. It names no cause, and the source explicitly says there is no link established between that incident and Brotli.

Patch, Verify, Then Restart

Operators should identify the Brotli implementation in each application and host, consult the relevant vendor or distribution advisory, and update to a listed fixed release where available. Teams should check language packages, system libraries, bundled dependencies and container images separately; updating an application-level package alone may not replace another bundled copy. For Node.js, the source lists fixed releases in versions 22, 24 and 26, while versions 20, 23 and 25 are listed without a fix.

After updating, restart affected services so processes load the patched decoder, then confirm the deployed version and review whether systems accept compressed data from untrusted sources. The source material does not give a single deadline or a complete final patch list. Its tracker described several bundled copies as still unfixed on October 26, so maintainers and operators should recheck current advisories for changes.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for the security issue tracked as CVE-2026-111497, involving memory corruption in Google’s Brotli decoder. The source says Imperva demonstrated code execution on an unmodified Node.js build.

Which software has fixes?

The source lists fixes for Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1; and brotlicffi 1.2.1.0. It also lists patched releases for Bun, Envoy, Istio, .NET and Debian. Check the relevant vendor advisory for the exact release used in your environment.

Is the flaw being exploited in the wild?

The supplied source reports no known in-the-wild exploitation as of October 26, 2026, citing CISA data that listed exploitation as “none.” It also says the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at that time. Researchers’ demonstration of code execution is separate from evidence of active attacks.

Why must affected services be restarted?

A running process may keep using the decoder it loaded before the update. The source advises restarting services after patching so they load the fixed code, and checking the deployed version afterward.

Does the DreamHost password reset relate to Brotli?

No connection is established in the supplied source. It says DreamHost reset some email and FTP/SFTP passwords after an incident, but names no cause and states that nothing links it to Brotli.

Source: ThorstenMeyerAI.com