Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
- ID
- 39328
- Status
- summarized
- Published
- 24 Oct 2026, 4:06 PM
- Fetched
- 26 Oct 2026, 4:08 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://broccoli2shell.com/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 9.2
- Created
- 26 Oct 2026, 4:09 AM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
CVE-2026-111497 (Broccoli2Shell) is an out-of-bounds write in Google's Brotli C decoder, present in libbrotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. GitHub rates it 9.2 Critical (CVSS 4.0); Node.js rates it High, with fixes in Node 26.12.1, 24.22.1 and 22.23.4 — Node 25, 23, 20 and older get no fix and are EOL. The root cause is that DecodeBlockTypeAndLength() in c/dec/decode.c returned a plain boolean, so callers could not distinguish a malformed stream from one needing more input, and the fast path ignored the return value, letting attacker bytes overflow an eight-byte internal buffer.
Why it matters
The exposure is mostly indirect: Node's built-in fetch() auto-decodes Content-Encoding: br responses, and Python's requests/urllib3 and aiohttp do the same when a Brotli package is installed, so any server you call — webhooks, link previews, crawlers, 'import from URL' features — can deliver the payload. Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli request bodies in raw()/json() parsers, but upgrading those won't help since they only route to the bug; you must bump Node.js itself (it bundles its own Brotli, so system libbrotli is irrelevant) or Python Brotli to 1.2.1 / brotlicffi to 1.2.1.0, then actually restart processes and rebuild container images on a patched base — a running process keeps the old decoder until restart.
Discussion angle
Map your own decompression surface live: which services auto-decode Brotli from third-party URLs or request bodies, and does your deploy pipeline actually restart the process or rebuild the image after the version bump? Then use the boolean-return bug as a design lesson — APIs that can't distinguish 'malformed' from 'need more input' fail open.