Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

CVE-2026-111497, dubbed Broccoli2Shell, is a critical flaw in Google’s C-based Brotli decoder, affecting versions 1.0.3 through 1.2.0. A malformed compressed stream can make the decoder treat an impossible block switch as a request for more input, then write beyond an eight-byte buffer. The resulting corruption can cause crashes or memory disclosure and, under some conditions, remote code execution. The issue stems from an unchecked return value; the fix reports a format error instead. Node.js, Python Brotli packages, and other products that bundle or link the vulnerable C decoder may be exposed when they decompress attacker-controlled data, including automatically decoded HTTP responses, request bodies, archives, and compressed files. Express and body-parser can provide an attack path, but do not contain the flaw themselves.

Fixed releases include Brotli 1.0.10, 1.1.1, and 1.2.1; Python’s Brotli package 1.2.1 and brotlicffi 1.2.1.0; and Node.js 22.23.4, 24.22.1, and 26.12.1. Older Node.js release lines have no fix and must be replaced. Reported testing achieved code execution on an unmodified Node.js build, while a public proof of concept reportedly crashes standard builds and can expose limited memory. Remediation requires checking direct, transitive, system, and vendored copies, updating dependencies and lockfiles, then restarting processes and rebuilding and redeploying containers. Where upgrades are delayed, Python Brotli packages can be removed and inbound Brotli request bodies blocked; these measures do not fully protect Node.js or outbound decompression.