Critical · exploited · Node, Python, .NET
Broccoli2Shell: the Brotli flaw in Node.js, Python and more
CVE-2026-111497 is a bug in the Brotli decoder: crafted compressed data writes past the end of a buffer, which can crash a process, leak memory or, on some builds, run code. It is also called Node2Shell and HTTP2Shell.
Why it matters to you
Any Node.js service, Python app using the Brotli packages, or software that decodes Brotli (a common web compression format) can receive crafted traffic. Several Node.js lines, including 20, are end of life, so they get no fix and have to move to a supported line.
Check it yourself
- 01Node.js: run
node --versionandnode -p "process.versions.brotli". Fixed releases are 22.23.4, 24.22.1 and 26.12.1. - 02Python: run
pip show Brotli brotlicffi. The fixed versions are 1.2.1 and 1.2.1.0. - 03Check container images and CI build images as well as servers.
- 04Search lock files for
brotli, and note where your proxy or load balancer acceptsContent-Encoding: br.
Fix it
- 01Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. Lines 25, 23, 20 and older have no fix, so move to a supported line.
- 02Upgrade the Python packages with
pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0"and update lock files. - 03Restart every process, rebuild container images on patched bases and redeploy.
- 04If you can’t upgrade yet, reject
Content-Encoding: brrequest bodies at the proxy, load balancer or WAF. Node.js has no workaround, so upgrading is the only complete fix.
How PatchRig helps
PatchRig finds every place the vulnerable decoder runs (runtimes, images, packages), upgrades on a staging copy, redeploys and confirms the versions that are running.