A Practical Guide To Broccoli2Shell For Node.js And Python Teams

🔍 Read the full analysis: A Practical Guide To Broccoli2Shell For Node.js And Python Teams on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security fixes for CVE-2026-111497, a flaw in Google’s Brotli decoder, now cover Node.js and Python packages as well as several other runtimes and products. The vulnerability can corrupt memory when a decoder processes crafted compressed data; Imperva reported running code in a demonstration against an unmodified Node.js build, while CISA data cited by the source showed no known exploitation in the wild as of October 26, 2026.

The bug affects Google’s Brotli C decoder versions 1.0.3 through 1.2.0. The Node.js advisory describes malformed input that the decoder treated as incomplete rather than invalid. That could lead it to write beyond an eight-byte internal buffer. The resulting memory corruption may crash a process or expose memory; code execution is a possible worst-case outcome, not a confirmed result for every affected application.

Published fixes include Node.js 22.23.4, 24.22.1 and 26.12.1, and Python’s Brotli 1.2.1 and brotlicffi 1.2.1.0. The source also lists fixed releases for Bun, Envoy, Istio, .NET and Debian. Node.js 20, 23 and 25 are listed as receiving no fix. Teams should check the versions they actually deploy and replace unsupported versions or assess their exposure rather than assuming a package-level update covers every installation.

Updating a dependency is not enough for an already-running service: processes need to restart to load the patched decoder. Exposure depends on how Brotli is used. Node’s built-in fetch decodes Brotli responses, while Python HTTP clients may do so when a Brotli package is installed. Some request-body parsers and file-processing tools also use the decoder. The vulnerability is in Brotli, not Express itself, so updating Express alone does not fix a vulnerable Brotli copy.

Patches Must Reach Every Runtime

The issue matters because Brotli is shared infrastructure: one decoder can appear inside language runtimes, packages, proxies and operating-system builds. A team may depend on it without calling the C library directly. The source says an independent tracker listed more than 30 projects and packages bundling their own copies, with seven copies still unfixed on October 26. That count is a tracker observation at that date, not a complete inventory of all affected software.

Fixing the library is only one step in the supply chain. Updates must reach the application dependency, runtime, distribution or container image, and then the running service. This makes an inventory of direct and transitive dependencies important, especially for applications that fetch external content, accept compressed request bodies or process files. The potential consequences are serious, but the available source does not establish widespread exploitation.

From February Fix to October Releases

The source reports that the underlying code change entered Brotli’s source repository on February 27, 2026, under a commit titled “Detect and report invalid stream earlier.” It says the change did not identify the issue as a security vulnerability at the time. OpenAI later stated that the security significance was not known then and that no newer Brotli release was available. Releases carrying the fix appeared on October 21, a reported 236-day gap.

The CVE became public on October 22, according to the source, and a public proof of concept appeared that day. Node.js shipped a security release on October 21, and subsequent fixes have appeared in Python packages and other projects. The source attributes discovery to AI-assisted security work: Node.js credited OpenAI Codex Security, while OpenAI said the flaw was found during red-teaming with teams of AI agents. Those accounts describe the discovery process; they do not change the need to verify affected versions independently.

“A bigger deal than PHP2Shell”

— Juliano Rizzo, as quoted by broccoli2shell.com

Exposure and Unfixed Copies

The source reports no known exploitation in the wild as of October 26: CISA’s data was listed as “exploitation: none,” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog. Imperva’s reported code-execution demonstration shows a potential impact under test conditions, but does not establish that attackers have used the flaw against real systems. The CVE record gives the issue a 9.2 Critical score under CVSS 4.0.

It is also not clear from the supplied material how many deployed services remain vulnerable or which unpatched bundled copies have reached production. The tracker named seven projects with unfixed copies at the reporting date, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. Some distributions may link Node.js to a system Brotli library rather than use the official bundled copy, so the affected version can vary by build. Teams should confirm against vendor advisories and their own software inventories.

The source separately mentions DreamHost password resets after an incident but says the company named no cause and provides no link to Brotli. That incident should not be treated as evidence of exploitation of this vulnerability.

Verify Updates and Restart Services

Node.js and Python teams should first identify runtime and package versions, including transitive dependencies and bundled libraries in containers or system packages. Upgrade to a listed fixed version where available, rebuild affected images, and restart services and workers so they load the updated decoder. Check vendor guidance for unsupported Node.js branches and for software that packages its own Brotli copy.

The next developments are likely to include further vendor advisories and fixes for remaining bundled copies. The source’s tracker reported that five additional projects had fixes in their main branches but not yet in released versions as of October 26. Teams should track those projects’ release status and reassess exposure as updates become available; the supplied information does not give a confirmed date for every pending release.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for the security issue involving CVE-2026-111497, a memory-corruption flaw in Google’s Brotli C decoder. The supplied source says the name refers to the library’s name and reports a code-execution demonstration, but that does not mean code execution is confirmed in every affected setup.

Which Node.js and Python versions are listed as fixed?

The source lists Node.js 22.23.4, 24.22.1 and 26.12.1, Python Brotli 1.2.1, and brotlicffi 1.2.1.0. It says Node.js 20, 23 and 25 receive no fix. Confirm the applicable vendor guidance and deployment build before upgrading.

Does updating Express fix the vulnerability?

No, not by itself. The flaw is in the Brotli decoder, not Express. If a service uses an affected Brotli package or bundled copy to decode request bodies, teams need to update that component and restart the process.

Has the flaw been exploited in the wild?

The source reports no known exploitation in the wild as of October 26, 2026, citing CISA data and the CVE’s absence from its Known Exploited Vulnerabilities catalog. Imperva reported a code-execution demonstration in a test, which is different from evidence of real-world attacks.

Source: ThorstenMeyerAI.com