CybersecurityOct 26, 2026 · Niche Press editorial

Broccoli2Shell: a Brotli decoder bug (CVE-2026-111497) puts Node.js, Bun, Envoy and Python on the patch list

Quotable summary

CVE-2026-111497, nicknamed “Broccoli2Shell” (also Node2Shell / HTTP2Shell), is an out-of-bounds write in Google’s Brotli decoder in versions 1.0.3 through 1.2.0. A malformed stream can make the decoder keep feeding bytes into an eight-byte internal buffer. That can lead to memory corruption, leaked memory, crashes, or potentially remote code execution. Brotli is the br in Content-Encoding: br, so the bug reaches into Node.js, Bun, Envoy, Istio, Python bindings and Go ports. Fixed Brotli 1.0.10 / 1.1.1 / 1.2.1 and Node.js 22.23.4 / 24.22.1 / 26.12.1 shipped on 21 October 2026. Bun 1.4.4 and patched Envoy releases followed on 23 October. The bug was reported by OpenAI’s Codex Security researchers. Translation: if your app will unzip anything a stranger hands it, patch now.

What changed

Where the bytes come in

The Bun advisory lays out the attack surface well, and the same logic applies to other runtimes:

• Outbound HTTP clients that send Accept-Encoding: br and auto-decode responses. A malicious server, or anyone on the path of an unencrypted connection, can feed the decoder.
• Explicit decompression APIs, such as Node’s zlib.brotliDecompress* / createBrotliDecompress and DecompressionStream('brotli').
• Proxies and gateways (Envoy, Istio) configured to decompress Brotli request or response bodies.

Why it matters

• Compression libraries sit under everything. Most teams never chose Brotli; it came bundled with their runtime, proxy or base image. That’s why you have to patch at the runtime, image and binary level, not just in package.json. Statically linked or bundled copies (like Bun single-file executables) need a rebuild.
• Severity depends on who you ask. Google’s CNA says 9.2 Critical. Red Hat says 8.1 Important. Its reasons: a malformed stream is required, and ASLR/NX/FORTIFY hardening make reliable RCE harder. Red Hat also says there’s no public, reliable RCE proof of concept. Wiz says researchers have demonstrated exploitation against unpatched Node.js (crediting Imperva’s Red Team). Either way, treat it as a memory-corruption bug reachable over the network.
• Vendor telemetry, labeled. Wiz reports that 91% of cloud environments it sees have resources vulnerable to this CVE. That’s a vendor-stated figure from Wiz’s own customer data, and GeekDad hasn’t verified it.
• AI found it. The bug came from OpenAI’s Codex Security team. Per Reuters (via The Hindu), OpenAI said the root cause had been fixed in Brotli’s source in February but never shipped in a release until now. AI-assisted bug hunting is turning up long-tail flaws in shared plumbing, and patch pipelines have to keep up.

FAQ

I only run Node.js. What do I do? Upgrade to 22.23.4, 24.22.1 or 26.12.1 (or later). Then rebuild container images and restart processes so the new binary is actually the one running. End-of-Life Node lines get no fix, so move off them.

Is it being exploited in the wild? As of 26 Oct 2026, it isn’t on CISA’s Known Exploited Vulnerabilities list, and the advisories we reviewed don’t report in-the-wild exploitation. Exploitability has been demonstrated in research settings, so don’t wait for a KEV entry.

Can I mitigate without patching? Only partly. Disable Brotli decompression or reject Content-Encoding: br before it reaches vulnerable components. In Bun, pass decompress: false to fetch per request. Every advisory says these steps reduce exposure but don’t replace patching.

How do I find hidden copies? Inventory runtimes, proxies, Python packages (brotli, brotlicffi), Go modules and base images. Use your SBOM or scanner, then check vendor advisories for anything that statically links libbrotli.

Sources