Broccoli2Shell

TL;DR

Upgrading on disk is not enough. A running process keeps the old decoder until it restarts. A container keeps it until you rebuild the image on a patched base and redeploy it.

The bug

A Brotli stream is split into blocks, and the decoder changes block types as it reads them. Before the fix, DecodeBlockTypeAndLength() in c/dec/decode.c returned a plain boolean. That meant callers could not tell a malformed stream from one that just needed more input. On the fast path, the return value was ignored altogether.

A crafted stream can request a block switch that cannot happen. The decoder took that as "need more input", so the streaming decoder kept adding attacker bytes to an eight-byte internal buffer and wrote past its end. The overwrite corrupts nearby decoder state, which is how a decompression error can become memory disclosure or code execution.

The upstream fix (google/brotli commit 0ed4268, plus 50a9b70, b418fa8 and da98063) makes the decoder return a hard format error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (−17), and pass it back to the caller.

Node.js

Node.js bundles its own copy of the Brotli decoder, so your operating system's libbrotli doesn't matter here. Only the Node.js version does. Node.js runs the decoder when:

Express and body-parser don't contain the bug. They only give attackers a way to reach it. Upgrading them won't help. Upgrading Node.js will.

The same release (2026-10-21) fixed nine other CVEs, including three more rated High in TLS and DNS. See the Node.js advisory.

Python

The PyPI packages Brotli and brotlicffi compile the same C decoder. Your code doesn't have to import them. If either one is installed, common HTTP clients use it automatically:

• urllib3, and therefore requests, sends Accept-Encoding: br and decodes Brotli responses whenever either package is installed.
• aiohttp uses Brotli if it's installed.
• httpx uses it through the httpx[brotli] extra.
• Scrapy and other crawlers. Some versions pull Brotli in as a dependency.
• Web frameworks or middleware that decode Content-Encoding: br request bodies.

If your Brotli bindings come from your Linux distribution (for example python3-brotli) rather than from PyPI, the fix will come through your distribution's security updates.

Everything else

The bug is in the reference C decoder, not in Node.js or Python. Anything that ships or links that decoder from Brotli 1.0.3 through 1.2.0 is a candidate, even if no advisory names it yet:

• The system library (libbrotlidec, packaged as libbrotli1, brotli and similar). Programs that link it dynamically are fixed when your distribution ships a patched package and you restart them. Statically linked or vendored copies need their own rebuild.
• Language bindings that wrap the C code, such as Java JNI wrappers, PHP and Ruby extensions, and Go cgo bindings. Check each one for a release that bundles 1.0.10, 1.1.1 or 1.2.1.
• Proxies, CDNs, HTTP clients and archive tools that decode br content using the C library.

Am I affected?

Node.js

node --version
# vulnerable if below 22.23.4 / 24.22.1 / 26.12.1, or on any EOL line

# inside a container image
docker run --rm --entrypoint node <image> --version

# the Brotli version actually bundled into this Node binary
node -p "process.versions.brotli"

Python

pip show Brotli brotlicffi
python -c "import brotli; print(brotli.__version__)"

# what pulls it in
pipdeptree -r -p Brotli

# lockfiles
grep -i brotli poetry.lock uv.lock requirements*.txt Pipfile.lock 2>/dev/null

# inside a container image
docker run --rm --entrypoint pip <image> show Brotli brotlicffi

System library

# Debian / Ubuntu
dpkg -l | grep -i brotli
# RHEL / Fedora
rpm -qa | grep -i brotli
# Alpine
apk info -v | grep -i brotli
# which running processes have it mapped
sudo grep -l brotlidec /proc/*/maps 2>/dev/null

Check every place that runs code: production, staging, CI runners, build images, serverless runtimes and developer laptops. Fix the services that fetch URLs you don't control, or that accept Content-Encoding: br bodies, first.

Fix & mitigate

1. Upgrade (the actual fix)

# Node.js — via your version manager, base image or package source
nvm install 24.22.1          # or 22.23.4 / 26.12.1
# Dockerfile
FROM node:24.22.1-slim

# Python
pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0"
# then update the constraint and regenerate poetry.lock / uv.lock / requirements.txt

Then restart every process, rebuild every image and redeploy. Bump pinned versions in lockfiles, so the next build doesn't install the old version again.

2. If you can't upgrade yet

• Python: uninstall Brotli and brotlicffi. urllib3, requests and aiohttp fall back to gzip and deflate. Also remove extras such as httpx[brotli], or the next install will bring the package back.
• Inbound: reject requests that carry Content-Encoding: br at your proxy, load balancer or WAF, before they reach the app. Several providers, including Vercel, deployed WAF rules for this inbound path on the day of disclosure.
• Outbound: removing br from Accept-Encoding helps less than it seems, because a malicious server can send Brotli anyway. A WAF in front of your app does nothing for responses your app fetches. Only the runtime or library upgrade protects that path.

Exploitation status

• Imperva Red Team ("Node2Shell") reported running attacker-supplied code on the official, unmodified Node.js 24.22.0 Linux arm64 image. The payload arrived both as a fetched response and as an Express request body. It took several attempts, and Imperva hasn't released the exploit code.
• A public proof-of-concept on GitHub (2026-10-22) reportedly reaches code execution only on a deliberately weakened build. On standard builds it causes a crash and a limited memory read.
• For the Python packages, researchers confirmed the bug with AddressSanitizer: 1.2.0 accepted a crafted ~23 MB stream, and 1.2.1 rejected it with error −17. They didn't try to build an exploit.
• As of 2026-10-22, no one had reported attacks using this flaw. Public PoCs make that likely to change, so patch now.

Timeline

1. 2026-02The fix is first committed to the Brotli source, according to OpenSourceMalware's analysis.
2. 2026-10-21Node.js releases 22.23.4, 24.22.1 and 26.12.1. Google releases Brotli 1.0.10, 1.1.1 and 1.2.1.
3. 2026-10-22NVD publishes CVE-2026-111497. GHSA-9v8h-qqgm-4m35 goes live, Brotli 1.2.1 reaches PyPI, Imperva publishes its "Node2Shell" research, and a public PoC appears.
4. 2026-10-23brotlicffi 1.2.1.0 reaches PyPI. Researchers publish the Python impact analysis, and GHSA is updated to list the PyPI packages.

Why "Broccoli"?

Imperva's research called it "Node2Shell", but the bug is in Brotli itself and reaches well beyond Node.js. Security researcher Juliano Rizzo proposed a better name:

IMHO, the Brotli bug (think zlib 20 years ago) is a bigger deal than PHP2Shell […] Node2Shell is a terrible name. I'm calling it Broccoli.

Credits

Reported to Node.js by OpenAI Codex Security (Khai Tran and Sylvie Mayer). Fixed in Node.js by Matteo Collina and Antoine du Hamel. Independent exploitation research by the Imperva Red Team (Ron Masas). Python impact analysis by OpenSourceMalware and Aikido.

References

• Node.js — October 2026 security releases
• GitHub Advisory GHSA-9v8h-qqgm-4m35
• NVD — CVE-2026-111497
• CVE.org record
• google/brotli releases (1.0.10 / 1.1.1 / 1.2.1)
• Imperva — Node2Shell: From Brotli Data to Remote Code Execution
• OpenSourceMalware — Python packages vulnerable to Node2Shell
• Aikido — Python packages are also vulnerable
• Vercel — Node.js security advisory