Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Original title: Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
Wiz describes CVE-2026-111497, called Broccoli2Shell, an out-of-bounds write in the Brotli C decoder. Unauthenticated attackers who supply crafted compressed data may cause memory corruption, information disclosure, crashes, or remote code execution. The flaw reaches Node.js, Bun, Envoy Proxy, Istio, Python bindings and a Go library. Researchers demonstrated exploitation against unpatched Node.js; fixes are available.
Unconfirmed: Researchers demonstrated exploitation; the text does not say attackers are using it in the wild.
- Google Brotli and Python Brotli 1.0.3–1.2.0 are fixed in 1.0.10, 1.1.1 and 1.2.1.
- Node.js unpatched 22.x, 24.x and 26.x are fixed in 22.23.4, 24.22.1 and 26.12.1.
- Bun 1.0.21–1.4.3 is fixed in 1.4.4; Go andybalholm/brotli is fixed in v1.2.7.
- Wiz reports 82% of cloud environments have publicly exposed Node.js instances.
- OpenAI Codex Security researchers discovered the flaw; Node.js maintainers implemented fixes.
Impact: Memory corruption, disclosure, crashes, or possible remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli / libbrotli | 1.0.3–1.2.0, excluding patched backports | 1.0.10, 1.1.1, 1.2.1 |
| Python Brotli | 1.0.3–1.2.0, excluding patched backports | 1.0.10, 1.1.1, 1.2.1 |
| Python brotlicffi | 1.0.3–1.2.0.x | 1.2.1.0 |
| Node.js | Unpatched 22.x, 24.x, 26.x releases | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.0.21–1.4.3 | 1.4.4 |
| Envoy Proxy | 1.36.11, 1.37.7, 1.38.5, 1.39.2 | 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0 |
| Istio | 1.29.0–1.29.8, 1.30.0–1.30.5, 1.31.0–1.31.1 | 1.29.9, 1.30.6, 1.31.2 |
| andybalholm brotli | Versions before v1.2.7 | v1.2.7 |
- 1.Upgrade affected Brotli libraries, Node.js, Python packages, Bun, Envoy Proxy and Istio to patched releases.
- 2.Where patching is delayed, disable Brotli decompression or reject Brotli-encoded requests.
- 3.Inventory workloads processing untrusted compressed data, then rebuild and redeploy images.
- CVEs
- CVE-2026-111497
- Vendors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
3 min read at wiz.io
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
By Merav Bar · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.