Broccoli2Shell Brotli Flaw Affects Node.js, Bun, Envoy and Other Products
Summary
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that can cause memory disclosure, crashes or potentially code execution when vulnerable components decompress attacker-controlled data. The article lists affected versions, fixes and mitigations.
Key points
- The out-of-bounds write occurs when the Brotli decoder processes specially crafted compressed data; exploitation requires a vulnerable application to decompress attacker-controlled input.
- Researchers demonstrated successful exploitation against unpatched Node.js environments; potential impacts include memory disclosure, process crashes and remote code execution.
- Affected products include Brotli libraries, Node.js, Bun, Envoy Proxy, Istio and Python packages; the article provides affected and patched versions.
- Wiz reports that 91% of cloud environments have resources vulnerable to the CVE and 82% have publicly exposed Node.js instances.
- Recommended actions include upgrading affected components, inventorying workloads and indirect dependencies, then rebuilding and redeploying affected images and processes.
- Where patching is not immediately possible, the article recommends temporarily disabling Brotli decompression or rejecting Brotli-encoded requests; these measures do not replace patching.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Severity
- Critical
- Affected Versions
- Google Brotli / libbrotli 1.0.3–1.2.0, excluding patched backports
- Python Brotli 1.0.3–1.2.0, excluding patched backports
- Python brotlicffi 1.0.3–1.2.0.x
- Node.js unpatched releases in 22.x, 24.x, and 26.x
- Bun 1.0.21–1.4.3
- Envoy Proxy 1.36.11, 1.37.7, 1.38.5, and 1.39.2
- Istio 1.29.0–1.29.8, 1.30.0–1.30.5, and 1.31.0–1.31.1
- andybalholm/brotli (Go) versions before v1.2.7
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable Brotli decompression where immediate patching is not possible.
- Reject Brotli-encoded requests before they reach vulnerable components.
- Restrict untrusted compressed responses where feasible.
MITRE ATT&CK
CVE
People
Antoine du HamelCredited with implementing fixes for the vulnerability in Node.js.Khai TranCredited with discovering and reporting CVE-2026-111497.Matteo CollinaCredited with implementing fixes for the vulnerability in Node.js.Ron MasasDemonstrated the vulnerability's exploitability.Sylvie MayerCredited with discovering and reporting CVE-2026-111497.
Products
andybalholm/brotliandybalholm/brotli (Go) Versions before v1.2.7 v1.2.7Brotlivulnerability, tracked as CVE-2026-111497 and referred to as Broccoli2Shell, has been identified in the Brotli decompression library. The vulnerability affects multiple widely used technologies, including Node.js,brotlicffiPython brotlicffi 1.0.3–1.2.0.x 1.2.1.0Bundecompression library. The vulnerability affects multiple widely used technologies, including Node.js, Bun, Envoy Proxy, and more. Successful exploitation could allow an unauthenticated remote attacker to triggerEnvoylibrary. The vulnerability affects multiple widely used technologies, including Node.js, Bun, Envoy Proxy, and more. Successful exploitation could allow an unauthenticated remote attacker to trigger memoryIstioIstio 1.29.0–1.29.8, 1.30.0–1.30.5, 1.31.0–1.31.1 1.29.9, 1.30.6, 1.31.2Node.jsthe Brotli decompression library. The vulnerability affects multiple widely used technologies, including Node.js, Bun, Envoy Proxy, and more. Successful exploitation could allow an unauthenticated remote attacker toPython BrotliPython Brotli 1.0.3–1.2.0, excluding patched backports 1.0.10, 1.1.1, 1.2.1