The Brotli bug that Node.js fixed earlier this week is not just a Node.js problem. The out-of-bounds write tracked as CVE-2026-111497, now nicknamed Broccoli2Shell (also Node2Shell and HTTP2Shell), lives in the upstream Brotli C decoder, and patched releases are now out for Bun, Envoy Proxy, Istio, the Python Brotli bindings and a Go port as well, according to an advisory by Wiz's Merav Bar.
That matters because Brotli is the compression format browsers and servers use to shrink web traffic, and it is decompressed automatically in a lot of places nobody thinks to look. The CVE record carries a CVSS score of 9.2 (critical).
A compression library most teams never chose directly
Wiz describes the flaw as the decoder mishandling specially crafted compressed data during block processing, which can write past the end of allocated memory. An unauthenticated remote attacker who can get a vulnerable application to decompress malicious Brotli data could crash the process, read sensitive memory, or potentially run code with that process's privileges.
The trigger is any path that decompresses attacker-controlled Brotli: incoming HTTP requests, responses fetched from external servers, or other untrusted compressed content. Wiz warns that some HTTP clients and frameworks decompress Brotli automatically once support is enabled, so an application can be exposed even if its own code never mentions Brotli.
Exploitation has moved past theory. Ron Masas of Imperva's Red Team demonstrated that the bug is exploitable, and Wiz says researchers have shown successful exploitation against unpatched Node.js environments. Wiz does not report exploitation in the wild, and the flaw is not on CISA's Known Exploited Vulnerabilities list.
The bug was discovered and reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security, with the Node.js fix written by Matteo Collina and Antoine du Hamel. Aikido separately analyzed its impact on the Python ecosystem. It is the second AI-found "2Shell" bug in a week, after the PHP engine flaws we covered in Hackers probe PHP2Shell as unvetted exploits flood GitHub.
Nine in ten cloud environments carry a vulnerable copy
According to Wiz data, 91% of cloud environments have resources vulnerable to CVE-2026-111497, and 82% of cloud environments have publicly exposed Node.js instances. Wiz points to containers, Kubernetes clusters, API gateways, reverse proxies and serverless workloads as the places Brotli-enabled components tend to hide, and notes that internal services which pull compressed responses from untrusted outside sources are an exploitation path too.
Upgrade every layer, from libbrotli to the service mesh
Wiz lists these affected and fixed versions:
- Google Brotli / libbrotli and Python Brotli: 1.0.3 to 1.2.0 affected (excluding patched backports); fixed in 1.0.10, 1.1.1 and 1.2.1.
- Python brotlicffi: 1.0.3 to 1.2.0.x affected; fixed in 1.2.1.0.
- Node.js: unpatched 22.x, 24.x and 26.x; fixed in 22.23.4, 24.22.1 and 26.12.1 (see our coverage of the Node.js release).
- Bun: 1.0.21 to 1.4.3 affected; fixed in 1.4.4.
- Envoy Proxy: 1.36.11, 1.37.7, 1.38.5 and 1.39.2 affected; fixed in 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0.
- Istio: 1.29.0 to 1.29.8, 1.30.0 to 1.30.5 and 1.31.0 to 1.31.1 affected; fixed in 1.29.9, 1.30.6 and 1.31.2.
- andybalholm/brotli (Go): versions before v1.2.7; fixed in v1.2.7.
Other products that bundle or statically link the Brotli C decoder may also be affected, so check vendor advisories for embedded copies. Patching the package is not enough on its own: rebuild container images and lockfiles, redeploy, restart running processes, and confirm the fixed library is actually the one loaded. Where an immediate upgrade is not possible, Wiz suggests disabling Brotli decompression or rejecting Brotli-encoded requests before they reach vulnerable components, while watching logs for unusual Brotli traffic and unexplained crashes. Those controls reduce exposure but do not replace the fix.
The lesson of Broccoli2Shell is that the Node.js advisory was only the first notice. A bug in a shared decoder travels with every runtime, proxy and mesh that quietly embeds it, and each of those needs its own upgrade.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.