Executive Summary
Broccoli2Shell (also known as Node2Shell and HTTP2Shell) refers to CVE-2026-111497, a critical out-of-bounds write vulnerability rated 9.2 on CVSS v4.0 in Google’s Brotli decompression library.
Brotli is used by many applications and platforms, including Node.js, Python packages, Bun, .NET, Envoy, and Istio. Applications may be exposed if they use an affected version to decompress data from untrusted sources.
The vulnerability allows specially crafted compressed data to overwrite process memory. Depending on the application and its configuration, threat actors could use it to crash a service, access sensitive information, or execute code without authentication. Exposure can occur through compressed incoming requests or responses that applications fetch from external servers.
Customers should check their applications and dependencies, apply the relevant vendor updates, and restart affected services.
This article will be updated as additional technical details become available and are verified.
Affected Products and Fixed Versions
| Product | Affected Upstream Releases | First Fixed Release |
|---|---|---|
| Brotli | 1.0.3–1.0.9, 1.1.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | Supported 22.x before 22.23.4; 24.x before 24.22.1; 26.x before 26.12.1 | 22.23.4; 24.22.1; 26.12.1. Unsupported lines received no security release. |
| Python | Versions before 1.2.1 | 1.2.1 |
| .NET | 8.x before 8.0.33; 9.x before 9.0.22; 10.x before 10.0.14; affected 11 previews before RC 3 | 8.0.33; 9.0.22; 10.0.14; 11.0.0-rc.3.26522.148. .NET Framework is not affected. |
| Bun | After 1.0.21 and before 1.4.4 | 1.4.4 |
| Envoy Proxy | Advisory identifies 1.36.11, 1.37.7, 1.38.5, and 1.39.2; exposure requires the Brotli decompressor to be configured | 1.36.12; 1.37.8; 1.38.6; 1.39.3; 1.40.0 |
| Istio | 1.29.0–1.29.8; 1.30.0–1.30.5; 1.31.0–1.31.1, when Brotli decompression is enabled | 1.29.9; 1.30.6; 1.31.2 |
| Brotli4j | All versions before 1.23.0, including its bundled native artifacts | 1.24.0 |
| ClickHouse | Builds carrying its Brotli 1.2.0 fork; the published 26.10.2.103 release predates the fix merge | No patched release yet |
| DuckDB | Builds carrying its vendored Brotli 1.1.0, including the then-current 2.0.0 release | No patched release yet |
| Apache Arrow | Arrow 26.0.0 pins Brotli 1.0.9 when built with that bundled dependency | No patched release yet |
Cynet Response and Investigation Guidance
Cynet Research is actively investigating Broccoli2Shell (CVE-2026-111497), tracking exploitation techniques, published indicators, and reported threat activity to assess the risk to customers and inform protection efforts.
Cynet’s CyOps MDR team is monitoring customer and partner environments for suspicious behavior associated with potential exploitation, including unexpected shell execution, unusual child processes, and suspicious outbound connections originating from applications that may use the affected Brotli decoder. Relevant findings support further investigation and response.
Cynet’s EPP provides visibility into process activity on monitored endpoints, helping CyOps and customers investigate what occurred before and after suspicious execution. For potential Broccoli2Shell incidents, this visibility can help trace activity from an affected application to commands, tools, or payloads launched afterward, supporting assessment of the scope of compromise and response.
Disclosure Timeline
- February 2026: The fix first lands in the Brotli source, according to OpenSourceMalware’s analysis.
- October 21, 2026: Node.js releases 22.23.4, 24.22.1 and 26.12.1. Google releases Brotli 1.0.10, 1.1.1, and 1.2.1.
- October 23, 2026: brotlicffi 1.2.1.0 reaches PyPI. Researchers publish the Python impact analysis, and GitHub adds the PyPI packages to its advisory.
Vulnerability Details
Brotli is a lossless compression format used, among other things, for HTTP content encoded as br. CVE-2026-111497 is in its C decoder. DecodeBlockTypeAndLength() handles a change of block type during decompression; the out-of-bounds write occurs later in BrotliDecoderDecompressStream().
When a stream declares at most one block type but reaches a block switch, DecodeBlockTypeAndLength() returns BROTLI_FALSE. In affected versions, that value also represents insufficient input. The streaming decoder therefore treats an impossible switch as a request for another byte and retries instead of rejecting the stream. The fix changes the return type from BROTLI_BOOL to BrotliDecoderErrorCode, adds a distinct block-switch format error, and makes callers propagate it.
On each retry, BrotliDecoderDecompressStream() can append an attacker-supplied byte to an eight-byte temporary buffer without an effective release-build bounds check. Once its index reaches eight, the write crosses into the adjacent buffer_length field, which controls subsequent indexing. Corrupting that state can enable further writes and, in a suitable exploit setup, code execution depends on the memory layout.
Recommendations
Cynet recommends that customers immediately identify and update any product deployments affected by Broccoli2Shell, tracked as CVE-2026-111497. This critical runtime vulnerability can enable unauthenticated remote code execution. Customers running unpatched products should immediately update to the corresponding fixed release or a later supported version.
Based on patchtheplanet, organizations that cannot patch immediately can apply the following mitigations until they roll out the patch:
- Incoming requests: Reject requests with
Content-Encoding: brbefore any proxy, middleware, or body parser decompresses them. Cover direct-to-origin and alternate routes. - Fetched responses: Disable automatic Brotli decompression in HTTP clients. Reject Brotli responses before decoding; if your client cannot do this, pause the affected fetch or use a patched client. Removing
brfromAccept-Encodingalone does not stop a server from sending it. - Envoy Proxy and Istio: Disable Brotli decompressor filters for both requests and responses. Disabling a filter can pass compressed data onward, so protect downstream decoders too.
- Files and other inputs: Pause untrusted Brotli processing until the decoder is patched.
Resources
- CVE-2026-111497
- Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
- Node.js — Wednesday, October 21, 2026 Security Releases
- Brotli: Out-of-bounds write in the Brotli decoder (“Node2Shell”) also affects the PyPI Brotli package · GHSA-9v8h-qqgm-4m35 · GitHub Advisory Database
- Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497) · Advisory · oven-sh/bun · GitHub
- Out-of-Bounds Write in Brotli Decompressor · Advisory · envoyproxy/envoy · GitHub
- Microsoft Security Advisory CVE-2026-111497 | .NET Brotli Decoder Out-of-bounds Write Vulnerability · Issue #494 · dotnet/announcements
- https://patchtheplanet.org/brotli