--- title: "Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)" slug: broccoli2shell-the-brotli-decoder-bug-cve-2026-111497 url: https://listedarticles.com/articles/broccoli2shell-the-brotli-decoder-bug-cve-2026-111497 canonical_url: https://broccoli2shell.com/ content_type: research language: en published_at: 2026-10-24T00:00:00.000Z updated_at: 2026-10-25T17:10:36.345Z authored_by: human publisher: "broccoli2shell.com" publisher_url: https://broccoli2shell.com/ topics: ["Security", "Open Source", "Infrastructure"] license: all-rights-reserved word_count: 1710 reading_minutes: 7 citation: "broccoli2shell.com. \"Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497).\" 24 Oct 2026. https://broccoli2shell.com/ (all-rights-reserved)" # The full text follows. The web page shows an extract and sends readers # to the source above; quote the citation and link the canonical URL. --- # Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497) > A write-up of CVE-2026-111497, an out-of-bounds write in Google's reference C Brotli decoder that can lead to code execution in Node.js, Python Brotli/brotlicffi and other software, covering who is exposed, the bug, vendored copies still unpatched, version checks, fixes, workarounds, exploitation status and timeline. ## Who's exposed You're at risk if your code, or any library it uses, decompresses Brotli data that someone else controls. That happens in more places than you'd think, because HTTP clients decompress Brotli responses on their own. - **Your app fetches a URL** Node's built-in `fetch()` decodes `Content-Encoding: br` responses automatically. So do Python's `requests`/`urllib3` and `aiohttp` whenever a Brotli package is installed. Any server you talk to can send the payload, whether through webhooks, link previews, crawlers or "import from URL" features. - **Your app accepts uploads or request bodies** Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli request bodies in parsers such as `raw()` and `json()`. Python frameworks and middleware that decode `br` bodies are exposed in the same way. A bare `node:http` server doesn't decode bodies by itself. - **Your app calls the decoder directly** This means `zlib.brotliDecompress*()`, `createBrotliDecompress()`, `brotli.decompress()`, and any library that uses them on archives, caches or queue messages. Express and body-parser don't contain the bug. They're just paths to it, so upgrading them won't help. Node.js bundles its own copy of Brotli, which means the system `libbrotli` doesn't matter there. Only the Node.js version does. ## The bug A Brotli stream is split into blocks, and the decoder switches between block types as it reads them. Before the fix, `DecodeBlockTypeAndLength()` in `c/dec/decode.c` returned a plain boolean, so callers couldn't tell a malformed stream from one that just needed more input. On the fast path, the decoder ignored the return value altogether. A crafted stream can request a block switch that can't happen. The decoder took that to mean "need more input" and kept adding attacker bytes to an eight-byte internal buffer, writing past its end. The overwrite corrupts nearby decoder state. That's how a malformed stream can turn into a memory leak or code execution. The upstream fix is google/brotli commit `0ed4268`, along with `50a9b70`, `b418fa8` and `da98063`. It returns a hard format error, `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (−17), to the caller. The bug is tracked as CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write). ## Python The PyPI packages `Brotli` and `brotlicffi` compile the same C decoder. Your code doesn't need to import them to be exposed. If either one is installed, these clients use it on their own: - **urllib3**, and therefore **requests**, advertises `Accept-Encoding: br` and decodes Brotli responses. - **aiohttp** uses Brotli when it's installed. - **httpx** uses it through the `httpx[brotli]` extra. - **Scrapy** and other crawlers. Some versions install Brotli as a dependency. Don't wait for your scanner. When this was disclosed, pip-audit, Dependabot and Safety didn't reliably flag the affected PyPI versions. The CVE record named the upstream Google repository, not the PyPI packages. GitHub's advisory now lists both packages (PYSEC-2026-4322 and PYSEC-2026-4323), but check by hand anyway. If your bindings come from your Linux distribution (for example `python3-brotli`) and not from PyPI, the fix arrives through your distribution's security updates. ## Other software The bug is in Google's reference C decoder, not in Node.js or Python. Anything that ships or links Brotli 1.0.3 through 1.2.0 may be affected, even before an advisory names it. - **The system library.** It's called `libbrotlidec`, packaged as `libbrotli1`, `brotli` and similar. Programs that link it dynamically are fixed once your distribution ships a patched package and you restart them. Statically linked or vendored copies need their own rebuild. - **Bindings that wrap the C code.** This covers Java JNI wrappers, PHP and Ruby extensions, and Go cgo bindings. Look for a release that bundles 1.0.10, 1.1.1 or 1.2.1. - **Proxies, CDNs, HTTP clients and archive tools** that decode `br` content with the C library. Decoders rewritten in other languages aren't a concern. The Java, JavaScript and C# ports, which pdf.js, iText and HtmlUnit use, can't reach the bug. The Go port (andybalholm/brotli) had the same logic error, but it would only have crashed, and it was fixed on 23 October. Rust's `brotli-decompressor` catches the condition and returns an error. Code execution is only possible in the C decoder. ## Projects that bundle their own copy Many projects ship a private copy of the C decoder instead of using your system's library. A distribution update doesn't fix those: each project has to update its copy. We searched GitHub for vendored copies and read their headers, and last rechecked them on 25 October 2026. A copy is patched if it includes the new `BLOCK_SWITCH` error code. Not fixed yet, as of 26 October | Project | Bundled copy | Untrusted input it decodes | | --- | --- | --- | | [.NET runtime](https://github.com/dotnet/runtime) | 1.1.0 | `BrotliDecoder`, `BrotliStream`, `HttpClient` automatic decompression, and request bodies in ASP.NET Core apps that use the [request decompression middleware](https://learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression). Microsoft confirmed it is working on a response in [issue #136422](https://github.com/dotnet/runtime/issues/136422). | | [DuckDB](https://github.com/duckdb/duckdb) | unpatched | Brotli-compressed Parquet files. A fix is in progress in [PR #27791](https://github.com/duckdb/duckdb/pull/27791). | | [Apache Arrow](https://github.com/apache/arrow) (bundled build) | 1.0.9 | Brotli-compressed Parquet files. Tracked in [issue #55166](https://github.com/apache/arrow/issues/55166). [PR #55167](https://github.com/apache/arrow/pull/55167), which moves to Brotli 1.0.10, has been approved but not merged. | | [v8-jsi](https://github.com/microsoft/v8-jsi) | 1.2.0 | The same paths as Node.js, because it bundles Node.js | | [7-Zip-zstd](https://github.com/mcmilk/7-Zip-zstd) | 1.2.0 | Archives and `.br` files a user opens. Tracked in [issue #579](https://github.com/mcmilk/7-Zip-zstd/issues/579). | | [p7zip](https://github.com/p7zip-project/p7zip) | 1.0.9 | Archives and `.br` files a user opens | | [EDK II](https://github.com/tianocore/edk2) | 1.2.0 | Compressed firmware sections. Tracked in [issue #13378](https://github.com/tianocore/edk2/issues/13378). | | [woff2](https://github.com/google/woff2) (Makefile build) | 1.0.3 | WOFF2 fonts passed to `woff2_decompress`. The CMake build links the system library instead. Tracked in [issue #207](https://github.com/google/woff2/issues/207). A fix has been proposed in [PR #208](https://github.com/google/woff2/pull/208). | Fixed since disclosure | Project | Fixed in | Details | | --- | --- | --- | | [Ruby `brotli` gem](https://github.com/miyucy/brotli) | 0.9.1 | Bundles Brotli 1.2.1 and refuses to build against an unpatched system libbrotli. Released on 24 October ([issue #64](https://github.com/miyucy/brotli/issues/64)). | | [PHP brotli extension](https://github.com/kjdev/php-ext-brotli) | 0.21.1 | Bundles Brotli 1.2.1. Released on 24 October ([PR #105](https://github.com/kjdev/php-ext-brotli/pull/105)). | | [UEFITool](https://github.com/LongSoft/UEFITool) | A76 | Bundles Brotli 1.2.1. Released on 24 October ([issue #492](https://github.com/LongSoft/UEFITool/issues/492)). | | [MuPDF](https://github.com/ArtifexSoftware/mupdf) | 1.28.0 | Its Brotli fork picked up the upstream fix in April 2026, before disclosure, so every 1.28.x release is patched. The 1.27.x releases still bundle the affected decoder. | | [ClickHouse](https://github.com/ClickHouse/ClickHouse) | master branch | Updated to Brotli 1.2.1 in [PR #127419](https://github.com/ClickHouse/ClickHouse/pull/127419) on 25 October and backported to 26.10. Backports to 26.9, 26.8 and 26.3 LTS are open. Not in a release yet: the latest, 26.10.2.103, came out before the fix. | | [NanaZip](https://github.com/M2Team/NanaZip) | main branch | Updated to Brotli 1.2.1 in [3da1c6a](https://github.com/M2Team/NanaZip/commit/3da1c6a7e8b194845691f1baa7ab14af63bc7da1) on 24 October. Not in a release yet: the latest, 7.0.1873.0, came out before the fix. | | [GraalJS (graal-nodejs)](https://github.com/oracle/graaljs) | master branch | The fix was merged on 22 October. Not in a release yet: GraalVM ships security updates quarterly, and the latest release, 25.4.4.1.1, came out before the fix. | | [YDB](https://github.com/ydb-platform/ydb) | main branch | Patched with the upstream fix in [343f6be](https://github.com/ydb-platform/ydb/commit/343f6bef21ac594c7993792b0006ddd8e6e0d183) on 23 October. Not in a release yet. | | [libjxl](https://github.com/libjxl/libjxl) | main branch | Updated to Brotli 1.2.1 in [PR #5062](https://github.com/libjxl/libjxl/pull/5062) on 24 October. Not in a release yet: the latest, v0.12.0, came out before the fix. | **Fixed before this list was made:** Node.js, Bun, Chromium, Firefox, brotlicffi, ngx\_brotli, Brotli4j, SumatraPDF, Ghostscript, CatBoost and YTsaurus, as well as Gentoo, Solus and VMware Photon packages. This list isn't complete. GitHub's code search skips submodules and some very large repositories, and private or vendored-at-build-time copies don't show up at all. A project listed here may not reach the decoder in every configuration. If you maintain one of these projects, updating to 1.0.10, 1.1.1 or 1.2.1 (or cherry-picking commit `0ed4268`) fixes it. ## Check your versions ### Node.js ``` node --version # affected if below 22.23.4, 24.22.1 or 26.12.1, or on an end-of-life line # the Brotli version bundled into this Node binary node -p "process.versions.brotli" # inside a container image docker run --rm --entrypoint node --version ``` ### Python ``` pip show Brotli brotlicffi # what pulls it in pipdeptree -r -p Brotli # lockfiles grep -i brotli poetry.lock uv.lock requirements*.txt Pipfile.lock 2>/dev/null # inside a container image docker run --rm --entrypoint pip show Brotli brotlicffi ``` ### System library ``` dpkg -l | grep -i brotli # Debian, Ubuntu rpm -qa | grep -i brotli # RHEL, Fedora apk info -v | grep -i brotli # Alpine # running processes that have the decoder loaded sudo grep -l brotlidec /proc/*/maps 2>/dev/null ``` Check everywhere code runs: production, staging, CI runners, build images, serverless runtimes and developer laptops. Patch first any service that fetches URLs you don't control or accepts `Content-Encoding: br` bodies. ## Fix it ### Upgrade ``` # Node.js: through your version manager, base image or package source nvm install 24.22.1 # or 22.23.4 / 26.12.1 FROM node:24.22.1-slim # Dockerfile # Python pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0" # then raise the constraint and regenerate poetry.lock / uv.lock / requirements.txt ``` Then restart every process, rebuild every image and redeploy. Update the pins in your lockfiles, or the next build will reinstall the vulnerable version. ### If you can't upgrade yet - **Python:** uninstall `Brotli` and `brotlicffi`. urllib3, requests and aiohttp will fall back to gzip and deflate. Remove extras such as `httpx[brotli]` too, or the next install brings the package back. - **Inbound:** reject `Content-Encoding: br` request bodies at your proxy, load balancer or WAF. Several providers, including Vercel, deployed WAF rules for this on disclosure day. - **Outbound:** removing `br` from `Accept-Encoding` helps less than you'd hope, because a malicious server can send Brotli anyway. A WAF doesn't see responses your app fetches. Only the runtime or library upgrade covers that path. Node.js has published no workaround. For Node.js, upgrading the runtime is the only complete fix. ## Exploitation status - **Imperva Red Team** ran attacker-supplied code on the official, unmodified Node.js 24.22.0 Linux arm64 image. They delivered the payload both as a fetched response and as an Express request body. It took several attempts, and they haven't released the exploit. - A **public proof of concept** appeared on GitHub on 2026-10-22. It reportedly reaches code execution only on a deliberately weakened build. On standard builds it causes a crash and a limited memory read. - For **Python**, researchers confirmed the bug with AddressSanitizer. Version 1.2.0 accepted a crafted stream of about 23 MB, and 1.2.1 rejected it with error −17. They didn't attempt an exploit. - As of 2026-10-22, no attacks in the wild had been reported. With public PoCs out, expect that to change. ## Timeline 1. Feb 2026The fix first lands in the Brotli source, per OpenSourceMalware's analysis. 2. 21 Oct 2026Node.js releases 22.23.4, 24.22.1 and 26.12.1. Google releases Brotli 1.0.10, 1.1.1 and 1.2.1. 3. 22 Oct 2026NVD publishes CVE-2026-111497 and GitHub publishes GHSA-9v8h-qqgm-4m35. Brotli 1.2.1 reaches PyPI, Imperva publishes its research, and a public PoC appears. 4. 23 Oct 2026brotlicffi 1.2.1.0 reaches PyPI. Researchers publish the Python impact analysis, and GitHub adds the PyPI packages to its advisory.