Node.js, Python, And Broccoli2Shell: A Checklist For Application Owners

🔍 Read the full analysis: Node.js, Python, And Broccoli2Shell: A Checklist For Application Owners on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security fixes for CVE-2026-111497, a memory-corruption flaw in Google’s Brotli decoder, are available for Node.js, Python packages and several other projects, prompting application owners to identify affected components and update them. For related Node.js security guidance, see the admin’s action checklist. The flaw can be triggered by crafted compressed data; an independent demonstration ran code on an unmodified Node.js build, while authorities and vulnerability records cited in the source material report no known in-the-wild exploitation.

The vulnerability affects Brotli C decoder versions 1.0.3 through 1.2.0. The Node.js advisory says malformed input could be treated as incomplete rather than invalid, allowing data to be written past an eight-byte internal buffer. The CVE record identifies an out-of-bounds write and an unchecked return value. Depending on the circumstances, memory corruption can crash a process, expose memory or potentially enable code execution.

Fixed versions listed in the source include Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; and Bun 1.4.4. The list also includes fixes for Envoy, Istio, .NET and Debian packages. These version numbers come from the source material dated October 26, 2026; owners should check the relevant project advisory for their platform and release channel.

Updating a dependency is not enough if the affected application process continues running with its old decoder loaded. The source advises restarting services after patching. It also says Node.js 20, 23 and 25 have no fix listed, so users of those release lines should consult Node.js guidance rather than assume a newer package resolves the issue.

Where Brotli Enters Your Application

The exposure is not limited to software that deliberately processes archive files. Brotli is used to compress web traffic, and runtimes or libraries may decode responses automatically. The source identifies Node.js fetch() and Python HTTP clients including requests/urllib3, aiohttp, httpx with its Brotli extra, and Scrapy as possible paths when the relevant package is installed. Webhooks, crawlers, link previews and URL-import features may therefore warrant review.

Inbound data is another route: the source lists Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 as versions that can inflate Brotli request bodies. It stresses that the flaw is in Brotli, not Express, so changing the web framework alone does not address it. A bare Node.js HTTP server does not decode request bodies on its own, according to the source.

Application owners should also account for copies bundled inside other tools and deployment images. Official Node.js builds include their own Brotli copy, while some Linux distributions use the system library instead. That difference affects which package needs patching. A fix must travel through dependencies, runtimes, operating-system packages and container images before the running service is protected.

From February Fix to October Advisory

The underlying Brotli source change was committed on February 27, 2026, with the commit titled “Detect and report invalid stream earlier.” The source says the change did not identify a security issue at the time. Releases carrying the fix appeared on October 21, and the CVE became public on October 22, according to the supplied reporting. That is a reported 236-day interval between the source fix and the releases.

After disclosure, maintainers began issuing downstream patches. The source reports that a public proof of concept appeared on GitHub on October 22 and that GitHub’s advisory later added the affected Python packages after scanners initially did not list them. As of October 26, an independent tracker cited by the source listed seven bundled copies still unfixed, including copies associated with DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II firmware tools; five others were fixed in their main branches.

The vulnerability is called Broccoli2Shell in the source material. That label refers to this Brotli issue; it does not establish that every product using Brotli is exploitable in the same way. The source also mentions DreamHost password resets as a separate incident and says no cause has been named or link to Brotli established.

Exploitation and Remaining Copies

The source reports a CVSS 4.0 score of 9.2, rated Critical, and says Imperva ran code on an official Node.js image after several attempts. That demonstration establishes a potential impact in that test, not widespread compromise. The supplied account says CISA data listed exploitation as “none” and that the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26. Those are time-specific status details, not guarantees that exploitation cannot occur.

It remains unclear how many deployed services are exposed, whether attackers have used the flaw privately, and when all projects with bundled copies will publish fixes. Package scanners may also miss a vulnerable copy embedded in a dependency or build. Owners should verify their own runtime, operating-system and container provenance rather than infer safety from an application-level package list alone.

Patch, Restart and Recheck

Application teams should inventory Brotli use across runtimes, libraries, operating-system packages, build artifacts and containers, then compare installed versions with the relevant vendor advisories. Pay particular attention to automatic decoding of fetched responses, compressed request bodies and software that reads Brotli-based files. Where a fix is available, update the affected component and restart every process that may have loaded the old decoder.

For components without a released fix, teams should monitor project and distribution advisories and consider whether the affected decoding path can be limited while they wait. The source’s tracker should be treated as a snapshot from October 26, not a complete or permanent inventory. Further downstream releases and updated security guidance are expected as maintainers address remaining bundled copies; the supplied material does not give a schedule for those releases.

Key Questions

What is Broccoli2Shell?

Broccoli2Shell is the name used in the source material for CVE-2026-111497, a flaw in Google’s Brotli decoder. Crafted compressed input can cause an out-of-bounds write, with potential memory-corruption consequences.

Does updating Express fix the issue?

Not by itself, according to the source. The vulnerability is in the Brotli decoder, not Express. Owners should identify and update the affected Brotli component used by their application and restart relevant processes.

Which Node.js versions have fixes listed?

The source lists fixed releases 22.23.4, 24.22.1 and 26.12.1. It says Node.js 20, 23 and 25 have no fix listed, so users should check current Node.js security guidance for their release line.

Has the vulnerability been exploited in the wild?

The supplied October 26 report says CISA’s data listed exploitation as “none” and the CVE was not in the Known Exploited Vulnerabilities catalog. It also describes a researcher demonstration that ran code on an official Node.js image. The report does not establish real-world exploitation.

Why must a service restart after patching?

A running process can continue using the decoder already loaded in memory. After installing the fixed component, restart affected services so they load the updated code.

Source: ThorstenMeyerAI.com