# Brotli compression library vulnerability

> Live situation record from CLSTR: https://clstr.news/situations/brotli-compression-library-vulnerability
> Updated: 2026-10-24T09:01:22.000Z. Sources: 8. Developments: 2.

A critical security vulnerability, identified as CVE-2026-111497 and nicknamed ‘Broccoli2Shell’, has been discovered in the Brotli decompression library. The flaw originates from an out-of-bounds write error in the upstream Brotli C decoder when handling specially crafted compressed data during block-processing operations.

With a CVSS score of 9.2, the vulnerability allows unauthenticated remote attackers to trigger memory corruption. Potential consequences include sensitive information disclosure, application crashes, and remote code execution (RCE). The issue impacts a wide range of technologies that utilize the library for data decompression, including Node.js, Bun, Envoy Proxy, Istio, and various Python applications.

Google has released patched versions of Brotli, specifically v1.2.1, v1.1.1, and v1.0.10. Affected downstream environments such as Node.js and Bun have also issued security updates to mitigate the risk. Researchers from OpenAI Codex Security, including Khai Tran and Sylvie Mayer, were credited with discovering the flaw.

## Claims

- The vulnerability is tracked as CVE-2026-111497. (corroborated by 3 sources)
- Exploitation can lead to remote code execution (RCE). (corroborated by 3 sources)
- The flaw is an out-of-bounds write vulnerability in the Brotli decoder. (corroborated by 2 sources)
- Affected technologies include Node.js, Bun, Envoy Proxy, and Istio. (corroborated by 2 sources)
- Python applications are also affected by the vulnerability. (corroborated by 2 sources)
- The vulnerability has a CVSS score of 9.2. (single source)
- Google released patched Brotli versions v1.2.1, v1.1.1, and v1.0.10. (single source)
- Khai Tran and Sylvie Mayer of OpenAI Codex Security discovered the vulnerability. (single source)

## Timeline

### 2026-10-24: Brotli compression library vulnerability affects Node.js and Python

A critical vulnerability (CVE-2026-111497) in the Brotli compression library allows remote code execution in Node.js, Bun, and Python applications. Patches are now available.

6 sources. https://clstr.news/cluster/critical-vulnerability-found-in-brotli-compression-library

### 2026-10-21: Cybersecurity threats evolve with BYOVD economy and Node.js vulnerability

Cybercriminals are industrializing BYOVD attacks to bypass EDR security, while a critical Node.js vulnerability named ‘Node2Shell’ allows for remote code execution via Brotli compression.

2 sources. https://clstr.news/cluster/cybersecurity-threats-evolve-with-byovd-economy-and-nodejs-vulnerability

---
Cite as: Brotli compression library vulnerability. CLSTR, https://clstr.news/situations/brotli-compression-library-vulnerability