Patch Broccoli2Shell: A Practical Checklist For Teams Across Ecosystems

🔍 Read the full analysis: Patch Broccoli2Shell: A Practical Checklist For Teams Across Ecosystems on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Fixes for CVE-2026-111497, known as Broccoli2Shell, now span several major software ecosystems after a flaw in Google’s Brotli C decoder was disclosed. The issue can cause memory corruption when a decoder handles crafted compressed data; teams using affected runtimes or bundled copies need to patch and restart services, while the supplied tracker listed seven bundled copies still unfixed as of Oct. 26, 2026.

The vulnerable range listed in the source is Brotli 1.0.3 through 1.2.0. Fixed upstream releases are 1.0.10, 1.1.1 and 1.2.1. Ecosystem fixes include Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; Envoy releases 1.40.0, 1.39.3, 1.38.6 and 1.37.8; Istio 1.29.9, 1.30.6 and 1.31.2; and .NET 8.0.33, 9.0.22 and 10.0.14. The source also lists Debian fixes for bookworm and trixie.

Updating a package is not enough for an already-running service: the source says processes retain the old decoder until restarted. Node.js 20, 23 and 25 are listed as receiving no fix, so teams on those release lines must assess their supported upgrade path rather than assume a patch is available. Official Node.js builds bundle Brotli, meaning the Node.js release is the relevant update there; some Linux distributions instead link Node.js against a system library.

The source describes exposure through automatic decoding of fetched responses, accepted compressed request bodies, and tools that process files such as archives or fonts. It names Node’s built-in fetch, Python HTTP clients when Brotli support is installed, and certain Express and body-parser versions as examples. The flaw is in Brotli, not Express, so upgrading Express alone does not address it. A bare Node.js HTTP server also does not decode request bodies automatically, according to the source.

Patches Must Reach Every Runtime

The practical challenge is software supply-chain reach. Brotli is used directly and bundled into other projects, so an organization may have vulnerable copies beyond its explicitly declared dependencies. A patch to the upstream library does not automatically update a runtime, container image, distribution package or application that carries its own copy.

The flaw is rated 9.2, Critical, under CVSS 4.0 in the Google-filed CVE record, as reported by the source. Imperva reportedly demonstrated code execution on an unmodified official Node.js image after several attempts. That is evidence of a possible severe outcome, not confirmation that attackers are exploiting it in live incidents. The source says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog at the time of reporting.

For operators, the immediate task is to map where Brotli is used, match each component to its fixed version, and restart affected processes after deployment. That matters for services that fetch remote content, accept compressed uploads or webhooks, and internal tooling that reads compressed files.

From Source Fix to Ecosystem Updates

The source traces the underlying code change to Feb. 27, 2026, when a Brotli commit titled “Detect and report invalid stream earlier” was made. It says that commit did not identify the change as security-related. Releases containing the fix appeared on Oct. 21, a 236-day interval, according to the article. The CVE became public on Oct. 22, alongside a public proof of concept, the source reports.

That gap matters because many projects bundle or depend on the same decoder. Updates must pass through successive maintainers and distributors before reaching deployed software. The source says a tracker identified more than 30 projects and packages with bundled copies, with seven still unfixed as of Oct. 26 and five more fixed in their main branches. It also reports that Python package advisories were absent from an advisory database on Oct. 23 before GitHub’s advisory was added later that day.

OpenAI is credited by Node.js with helping identify the vulnerability. OpenAI said it found the flaw during red-teaming with teams of AI agents, according to the source. That attribution describes the reported discovery process; it does not change which components require fixes.

Exposure and Remaining Copies

Actual exploitation in the wild is not confirmed in the supplied material. It reports a critical CVSS score and a researcher demonstration, while CISA data showed no exploitation and the CVE was not in the agency’s KEV catalog as of the article’s reporting date. Those status indicators do not rule out later activity.

The source does not provide a complete inventory of deployed systems affected or establish which organizations are exposed. Its tracker snapshot is dated Oct. 26 and identifies seven bundled copies as still unfixed, but status can change as maintainers publish releases. Teams should verify the current release and advisory for each component rather than infer safety from a dependency scanner alone.

The precise risk depends on how an application reaches the decoder and what it does with decoded data. The source describes possible crashes, memory disclosure or code execution, but it does not establish that every vulnerable deployment is remotely exploitable. DreamHost’s reported password resets for some email and FTP/SFTP accounts are a separate incident: the source says DreamHost named no cause and provides no link to Brotli.

Verify, Patch, Then Restart

Teams should inventory direct dependencies and bundled Brotli copies across runtimes, system packages, containers and file-processing tools. Compare each version with its vendor’s advisory, including any distribution-specific backport, then deploy the fixed release and restart processes so they load the corrected decoder.

Where a supported fixed release is unavailable, teams should check the maintainer’s current guidance and assess whether the affected decoding path can be restricted while a patch is pending. They should also repeat scans after updates: the supplied source describes advisories arriving at different times and some fixes landing in main branches before packaged releases.

The next milestone is the release of fixes by remaining maintainers and confirmation that those updates have reached downstream packages and deployed images. The source’s seven-unfixed-copy figure is a dated snapshot, not a permanent count; teams should check current advisories and vendor notices before closing remediation work.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. The source says malformed compressed input can trigger an out-of-bounds write and memory corruption.

Which versions contain the fix?

The listed upstream fixes are Brotli 1.0.10, 1.1.1 and 1.2.1. The appropriate version varies by runtime or distributor; the source lists specific fixed Node.js, Python, Bun, Envoy, Istio, .NET and Debian releases.

Does upgrading Express fix the issue?

No, not by itself. The source says the flaw is in Brotli, not Express. Applications using affected body parsers need to update the Brotli component or runtime that performs decoding, then restart the process.

Is Broccoli2Shell being exploited in the wild?

The supplied source reports no confirmed in-the-wild exploitation as of Oct. 26, 2026. It says CISA data listed exploitation as “none” and the CVE was not in the KEV catalog, while also describing a researcher demonstration of code execution.

Why must affected services be restarted?

According to the source, a running process keeps using its already-loaded decoder after a package update. Restarting the service loads the patched code.

Source: ThorstenMeyerAI.com