A Compression Bug Spans Node.js And Python: Responding To Broccoli2Shell

🔍 Read the full analysis: A Compression Bug Spans Node.js And Python: Responding To Broccoli2Shell on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Fixes are spreading across Node.js, Python packages and other software for a flaw in Google’s Brotli decoder that can corrupt memory when processing malformed compressed data. The vulnerability, CVE-2026-111497, affects decoder versions 1.0.3 through 1.2.0; researchers reported code execution in a demonstration against an unmodified Node.js build, while CISA data cited in the source reported no known exploitation as of October 26, 2026.

The flaw occurs when the decoder treats certain malformed input as incomplete data and continues processing it. According to the Node.js advisory, this can cause writes past an eight-byte internal buffer. The resulting memory corruption could crash a process, expose memory contents or, in the worst case, enable code execution. The CVE record identifies an out-of-bounds write and an unchecked return value; the fix makes the decoder stop with a format error.

Imperva reported running code after several attempts against an official Node.js image. That is a demonstration of potential impact, not evidence that attackers have used the flaw against real-world targets. The CVE record gives it a CVSS 4.0 score of 9.2, rated Critical. The source reports that CISA’s exploitation data said “none” and that the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog as of October 26.

Fixes listed in the source include Brotli C library versions 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. Updates are also listed for Envoy, Istio, .NET and Debian. Node.js 20, 23 and 25 are identified as receiving no fix. Official Node.js builds include their own Brotli copy, though some Linux distributions link Node.js to a system library instead.

One Decoder, Many Software Stacks

The practical risk is not limited to teams that knowingly installed Brotli. A decoder can arrive through a runtime or a transitive dependency, and an application may process attacker-controlled compressed data through network responses, submitted request bodies or files. Teams need to identify the actual decoder in use, not just check whether their application directly names Brotli.

The reported demonstration raises the stakes, but it does not establish widespread compromise. CISA’s reported “none” exploitation status is a time-stamped assessment, not a guarantee that the flaw will remain unused. For operators, the immediate priority is to apply the appropriate vendor fix, rebuild affected images where needed and restart services. For maintainers, the remaining bundled copies show why fixing an upstream library does not automatically protect downstream users.

How the Fix Reached Users

Brotli is a compression format used to reduce the size of web content and other data. Applications need a decoder to unpack compressed input. The vulnerability is in Google’s Brotli C decoder, rather than in Express or another framework that may call it. The source says Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 can inflate Brotli request bodies in some parsers, but upgrading those packages alone does not replace the vulnerable decoder.

Node.js’s October 21 security release initially included the Brotli issue among several vulnerabilities and rated it High, according to the source. Since disclosure, updates have also appeared for Python packages and several infrastructure components. The source quotes security researcher Juliano Rizzo describing the issue as “a bigger deal than PHP2Shell” and comparing it with “zlib 20 years ago”; those are his assessments, not official severity determinations.

The source separately mentions DreamHost resetting some email and FTP/SFTP passwords after an incident. It says DreamHost has not named a cause and provides no evidence linking that incident to the Brotli flaw.

Exploitation and Remaining Copies

As of October 26, the source reports no known exploitation in the wild, citing CISA data. That status does not rule out undiscovered activity, and the available information does not establish how often affected software has been exposed to hostile compressed input. Imperva’s reported code-execution demonstration shows a possible outcome under test conditions, not confirmed attacks on deployed systems.

Some projects still had unfixed bundled copies, and the status of a project’s main branch does not establish that a stable release or installed package is corrected. The source does not provide a complete inventory of every affected deployment or confirm that all listed fixes have reached all distributions. It also does not establish a link between the separate DreamHost password resets and this vulnerability.

Patch, Restart and Check Bundles

Operators should compare their deployed Node.js, Python, Brotli, proxy and system-library versions with vendor advisories, then install the fixed release that applies to their environment. Teams using official Node.js builds should check the Node.js version; deployments linked to a distribution-provided Brotli library should check that package as well. For Python, check both Brotli and brotlicffi where installed.

After updating, restart running services so the corrected decoder is loaded, and rebuild containers or other artifacts that contain bundled libraries. Maintainers and security teams should follow advisories for projects that had not yet released a fix, including the bundled copies named by the tracker. The source’s status is dated October 26, 2026, so downstream release and exploitation information may change.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for the security issue involving memory corruption in Google’s Brotli decoder, tracked as CVE-2026-111497. The name reflects the reported potential for code execution in a demonstration; it does not mean every affected installation has been compromised.

Which versions are affected?

The source identifies Brotli C decoder versions 1.0.3 through 1.2.0 as affected. Exposure in a particular product depends on which decoder copy it uses and whether that software processes relevant compressed input.

What should Node.js and Python teams update?

The listed Node.js fixes are 22.23.4, 24.22.1 and 26.12.1; Node.js 20, 23 and 25 are listed as receiving no fix. The listed Python updates are Brotli 1.2.1 and brotlicffi 1.2.1.0. Check vendor guidance for the right supported release in your environment.

Does installing an update protect a running service immediately?

No. The source says a running process can continue using the decoder it already loaded. After applying the fix, restart affected processes and rebuild images or artifacts that package their own Brotli copy.

Is the vulnerability being exploited in the wild?

The source reports that CISA’s exploitation data said “none” as of October 26, 2026, and the CVE was not in the Known Exploited Vulnerabilities catalog. Researchers did demonstrate code execution in a test against an official Node.js image; that is distinct from confirmed real-world exploitation.

Source: ThorstenMeyerAI.com