Broccoli2Shell: How To Check Your Applications After Applying A Patch

🔍 Read the full analysis: Broccoli2Shell: How To Check Your Applications After Applying A Patch on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Broccoli2Shell, a vulnerability in Google’s Brotli decompression library, affects versions 1.0.3 through 1.2.0 and has prompted fixes across Node.js, Python packages and other software. A report published October 26 says teams should check for bundled copies as well as direct dependencies, install the relevant fixed release and restart running applications, which otherwise may continue using the vulnerable decoder.

The flaw, tracked as CVE-2026-111497, involves malformed compressed data that the decoder can treat as incomplete rather than invalid. According to the Node.js advisory cited in the report, this can cause writes beyond an eight-byte internal buffer. The resulting memory corruption could crash a process or expose memory; code execution is a demonstrated possibility, not an outcome established for every affected application.

Fixes listed in the report include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; and Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Other named updates include Bun 1.4.4, several Envoy and Istio releases, and .NET runtime versions 8.0.33, 9.0.22 and 10.0.14. The correct target depends on the software and its packaging.

For Node.js, the report says official builds include their own Brotli copy, so updating Node.js is the relevant step for those installations. Some Linux distributions instead link Node.js to a system library. Python applications may use Brotli indirectly through HTTP clients or crawlers, while servers and tools may decode incoming request bodies or files. Updating a framework alone may not update its Brotli dependency.

Patching Across Runtime Dependencies

The issue matters because Brotli is embedded in a wide range of software, so the vulnerable code may be present without an application team adding the C library directly. Exposure depends on whether a program actually processes attacker-controlled or otherwise malformed Brotli data; the mere presence of a package does not establish that a system is exploitable.

The report cites an Imperva demonstration that ran code on an unmodified Node.js image after several attempts. That is evidence of a possible impact in a particular test, not proof of exploitation across all products. It also says Google’s CVE record assigns a 9.2 Critical score under CVSS 4.0, while CISA data listed exploitation as none and the vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog at the time of the report.

Patch deployment is not complete when a package file changes. Services, workers and containers already in memory can keep the old decoder loaded until they restart. Teams need to verify the running version after redeployment and account for images, system libraries and applications that bundle their own copy.

From Library Fix to Runtime Releases

The report traces the source-code fix to February 27, 2026, when a Brotli change titled “Detect and report invalid stream earlier” was committed. The fix did not identify the change as security-related at that point, according to the report. Releases carrying it appeared on October 21, creating a reported 236-day gap between the source change and those releases.

The CVE became public on October 22, and a public proof of concept appeared on GitHub the same day, according to the report’s cited tracker. Patches then had to move through upstream libraries, language runtimes, package maintainers, Linux distributions and deployed services. The report says Python packages were missing from advisory databases on October 23 before GitHub added an advisory later that day.

As of October 26, the report’s independent tracker listed more than 30 projects and packages that bundle Brotli. It identified seven bundled copies as still unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools; five more had fixes in their main branches. These are tracker findings reported on that date, not a complete inventory of every deployment.

“A bigger deal than PHP2Shell”

— Juliano Rizzo, security researcher, as quoted by the broccoli2shell.com tracker

Remaining Exposure and Exploitation Status

The report says CISA data listed no exploitation and that the CVE was not in the Known Exploited Vulnerabilities catalog as of October 26. Those records do not establish that every incident has been ruled out. The report does not identify confirmed real-world attacks, and it does not show whether every affected vendor or project has issued an update.

It is also not yet clear from the material which deployments are exposed in practice. That depends on whether the affected decoder is present, whether the application processes malformed Brotli input, and whether a patch has reached the running process. The tracker’s list of unfixed projects may change after publication, and it cannot by itself confirm the status of each installation.

Node.js 20, 23 and 25 are listed as receiving no fix. The source does not explain whether those branches are unsupported or whether another mitigation is available for each deployment. Operators using them should consult the relevant vendor or distribution guidance rather than assume a newer patch applies.

Verify Updates and Restart Services

Teams should inventory Brotli versions in application dependencies, operating-system packages, runtime builds and software that vendors or projects bundle. Compare each component with its own security advisory, since a package’s fixed version may differ from the version supplied by a runtime or Linux distribution. Check indirect dependencies used for HTTP responses, request-body parsing, webhooks, crawlers, file imports and archive processing.

After applying an applicable update, redeploy or restart affected services and workers, then verify the version actually loaded in production. Rebuild container images where necessary and check that replacement instances have started. Track projects without a released fix through their official advisories and apply vendor-recommended mitigations when available. The report provides no single deadline or universal mitigation for components that remain unpatched.

Key Questions

What is Broccoli2Shell?

It is the name used for CVE-2026-111497, a memory-corruption vulnerability in Google’s Brotli decoder. The report says affected upstream versions are 1.0.3 through 1.2.0.

Does a patched package protect a running service immediately?

Not necessarily. The report says a running process can keep using the old decoder until it is restarted or redeployed. Confirm the patched version is loaded after the restart.

Which Node.js versions are listed as fixed?

The report lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed releases. It says Node.js 20, 23 and 25 have no fix listed in the material.

Is Broccoli2Shell being exploited in real attacks?

The source report says CISA data listed exploitation as none and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It does not report confirmed in-the-wild exploitation.

Could my application be affected without directly using Brotli?

Yes. A runtime, HTTP client, server framework, operating-system package or bundled tool may include the decoder indirectly. Check dependency and vendor advisories, then confirm which decoder your deployed application actually uses.

Source: ThorstenMeyerAI.com