The Broccoli2Shell Checklist: Update Dependencies And Verify Restarts

🔍 Read the full analysis: The Broccoli2Shell Checklist: Update Dependencies And Verify Restarts on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get audio and creator gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are now available for several runtimes and packages, but operators must update affected software and restart running processes to load the patched decoder. The vulnerability affects Brotli versions 1.0.3 through 1.2.0; the source reports that researchers demonstrated code execution on an unmodified Node.js build, but no exploitation in the wild has been reported in the cited records.

The flaw, nicknamed Broccoli2Shell, is in Brotli’s C decoder, which decompresses data received by software. The source’s account of the Node.js advisory says malformed input could be treated as data that was still arriving rather than as invalid, allowing writes past an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on the affected application and how the decoder is reached, memory corruption can cause a crash or potentially enable more serious outcomes.

Fixed versions listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python’s Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. The listed fixes also cover Envoy, Istio, .NET and Debian packages. Node.js versions 20, 23 and 25 are listed as receiving no fix, so users of those releases need to check their support and upgrade options rather than assume a patch is forthcoming.

Updating a package does not necessarily update a process that is already running: the process can retain the old decoder until it restarts. Exposure depends on whether an application actually processes Brotli data. The source identifies examples including automatic decompression of fetched responses, Brotli request-body parsing in some middleware configurations, and tools that inspect compressed files. Express users should note that the source says the flaw is in Brotli, not Express; upgrading Express alone does not replace a vulnerable decoder.

Why Restarts Matter Across Stacks

Brotli is used across web servers, client libraries, runtimes and file-processing tools, so a flaw in the shared decoder can reach systems that do not appear to use Brotli directly. A dependency may arrive transitively through a package or be bundled inside a runtime or application. The source cites an independent tracker listing more than 30 projects and packages with their own Brotli copies, and says seven bundled copies remained unfixed as of October 26.

That spread makes patching a supply-chain task, not just a library upgrade. Teams need to identify which component supplies Brotli, apply the relevant vendor release, rebuild or replace affected images where needed, and restart services. A dependency scanner may not catch every case: the source says Python packages were absent from an advisory database on October 23 before an advisory was added later that day. Inventory and restart checks therefore matter alongside automated alerts.

The severity is high, but readers should distinguish potential impact from confirmed incidents. Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0. Imperva reported running code on an official Node.js image after several attempts, according to the source. That demonstration indicates exploitability in a test setting; it does not establish that attackers have used the flaw against real systems.

From February Fix to October Releases

The source says the underlying Brotli code change was committed on February 27, 2026, under a commit titled “Detect and report invalid stream earlier.” It did not identify the change as security-related at the time. Releases containing the fix appeared on October 21, a gap the source calculates as 236 days. OpenAI said the security significance was not known when the change was made and that no newer Brotli release was available.

The issue became public on October 22, according to the source, alongside a public proof of concept. Node.js had shipped a security release the day before that included the Brotli issue among other fixes; follow-up packages and distribution advisories have since extended the response. The source describes the issue as broader than a single Node.js release because Python packages, proxies, runtimes and software with bundled copies can also carry the decoder.

The source also mentions a separate DreamHost password-reset notice affecting some email and FTP/SFTP accounts. It says DreamHost did not identify a cause and that no link to Brotli has been established. The password resets should not be treated as evidence of Broccoli2Shell exploitation.

Affected Copies and Exploitation Status

The available source reports no known exploitation in the wild: it cites CISA data marked “exploitation: none” and says the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26. Those indicators describe the status reported at that time and do not prove that exploitation is impossible or that every incident would be detected. The source does not provide evidence of attacks against production systems.

The complete inventory is also unsettled. The source’s tracker lists seven bundled copies as still unfixed on October 26, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; it says five more had fixes in their main branches. A fix in a project’s main branch does not necessarily mean a released, deployable version is available. Which products are affected can also depend on whether they bundle Brotli or link against a system library.

The source gives no organization-specific exposure data, affected-host counts or evidence that a particular service is vulnerable merely because it uses Node.js, Python or another listed runtime. It also does not establish whether every listed distribution package has reached every mirror or deployment. Operators need to check the advisories for their exact versions and build configuration.

Patch, Rebuild, Then Restart

Administrators should first identify Brotli in direct and transitive dependencies, runtime bundles, operating-system packages and file-processing tools. They should then apply the fixed version recommended for each product, following vendor advisories where a distribution or runtime carries its own copy. For containers and other immutable deployments, that generally means rebuilding or replacing the affected image with one containing the fixed component, then deploying it.

After the update, teams should restart or redeploy every affected process and confirm that the running version is patched. They should also review services that automatically decompress remote responses or accept Brotli-compressed bodies, along with scheduled jobs and tools that parse compressed files. Where no released fix is available, organizations should track the vendor’s status and consider limiting the relevant input path based on their own risk assessment.

Further updates are expected as runtimes, distributions and projects with bundled copies publish advisories or releases. The source’s status snapshot is dated October 26, 2026; teams should check current vendor notices rather than assume the listed release set or unfixed-project count remains unchanged.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used for CVE-2026-111497, a flaw in Google’s Brotli C decoder. The source says malformed compressed input can cause an out-of-bounds write and memory corruption.

Which versions are listed as fixed?

The source lists Brotli 1.0.10, 1.1.1 and 1.2.1, along with fixes for several runtimes and packages. Examples include Node.js 22.23.4, 24.22.1 and 26.12.1, and Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Check the advisory for the exact product and distribution you run.

Why is restarting necessary after patching?

A running process can continue using the decoder it loaded before the update. Restarting or redeploying is needed for that process to load the patched component.

Has the flaw been exploited in real-world attacks?

The source reports no known exploitation in the wild as of October 26, 2026, citing CISA data marked “exploitation: none” and the CVE’s absence from CISA’s Known Exploited Vulnerabilities catalog. It also describes a researcher demonstration of code execution; that is not evidence of a real-world attack.

Does upgrading Express fix the issue?

Not by itself, according to the source. The vulnerability is in Brotli, not Express. Applications that use middleware to decompress Brotli request bodies should update the affected decoder dependency and restart the process.

Source: ThorstenMeyerAI.com