Broccoli2Shell (CVE-2026-111497): what businesses should do now

Status as of 27 October 2026. The situation is still developing, so check the latest vendor information before you act.

Broccoli2Shell, also known as Node2Shell, is a Brotli vulnerability (CVE-2026-111497) in the decoder of Google's compression library, the part that unpacks compressed data. Google rates it 9.2 out of 10 (CVSS 4.0). Brotli is used in Node.js, in Python packages, in a PHP extension and in Palo Alto firewalls. Fixes for Brotli and Node.js were released on 21 October 2026, and the main advice is simple: update.

If a vendor looks after your website or application, send them this article. Only someone with access to the server can check this.

What Broccoli2Shell is and why everyone is talking about it

One flaw, several names

The flaw has no official name. The name Broccoli2Shell spread from an unofficial website, while GitHub and some security firms call it Node2Shell and some media outlets HTTP2Shell. In every case it is the same flaw, CVE-2026-111497. It was found by researchers at OpenAI Codex Security.

How serious it is: 9.2 out of 10 and what remote code execution means

The attacker does not need to log in. All it takes is sending crafted Brotli-compressed data over the network. When the application starts unpacking it, the decoder can write data outside its allocated memory. The result can be a crash, a memory disclosure or, in the worst case, an attacker's code running on your server.

Google, as the CVE issuer, rates the flaw 9.2 out of 10 on CVSS 4.0, which counts as critical. Other vendors rate it less severely: Node.js rates it High, and Microsoft gives it 8.1 (CVSS 3.1) for .NET. An attack also requires certain conditions to be met, so not every server using Brotli is automatically at risk.

Who is affected

One distinction matters. The flaw is in Brotli decompression, not compression. The systems at risk are those that receive and unpack Brotli data.

Node.js applications: what is affected

Node.js unpacks Brotli through its built-in zlib module, so it is affected. On release lines 22, 24 and 26, update to the patched release, including in the Docker images your application runs from. Node.js 20 and older will not get a fix. Node.js has not published any workaround; updating is the only solution.

Watch out for Node.js from Linux distributions. On Ubuntu 22.04 and later it uses the system Brotli library, so updating the brotli package fixes it. Node.js 18 and 20 from the Debian repositories remain vulnerable.

Python: the brotli and brotlicffi packages

In Python, the flaw affects the installed brotli and brotlicffi packages. Update them to 1.2.1 and 1.2.1.0 respectively, and remember to update your dependency lock files too.

PHP: a typical website is probably fine

Here is some good news for most business websites. A typical PHP website (WordPress or another CMS) running on Apache or nginx uses Brotli only to speed things up, by compressing responses. According to their documentation, mod_brotli and ngx_brotli only compress data and do not unpack incoming Brotli. In our assessment, such a website is probably not affected through the web server.

It is different where a PHP application unpacks Brotli data itself, for example through the PHP brotli extension or the system Brotli library. Those setups need updating.

Broccoli2Shell is not related to last week's PHP flaws. If you have not updated PHP yet, read our article PHP2Shell: critical PHP vulnerabilities.

Palo Alto firewalls (PAN-OS)

For Palo Alto firewalls, PAN-OS 11.2, 12.1 and 12.2 are affected, but only with Brotli inspection and TLS decryption enabled. Since version 11.2.4, Brotli inspection is disabled by default. The management interface, Panorama and versions 11.1 and 10.2 are not affected.

.NET and Linux servers

For .NET applications, updating the runtime is enough; .NET Framework is not affected. Self-contained and NativeAOT applications need to be rebuilt. On Linux servers, updating the system brotli package does the job.

What businesses should do now

1. Find out what you run. Ask your vendor or hosting provider for a list: Node.js version, system Brotli library, Python packages, PHP extensions, .NET and firewall.
2. Update to the patched versions listed in the table above.
3. Restart processes and rebuild containers. The update only takes effect after a restart, and Docker images need to be rebuilt.
4. Update locked dependency versions so the old version does not come back with the next deployment.
5. Plan a move away from old versions. Node.js 20 and older will not get a fix.

For most servers this is a routine patch. If you have no one to do it, use our urgent programming help.

If you cannot update straight away: temporary measures

• Node.js: there is no workaround; updating is the only way.
• Palo Alto PAN-OS: until the hotfix is installed, you can disable Brotli inspection with set system setting brotli-encoding disable.
• .NET: neither ASP.NET Core nor HttpClient decompresses Brotli by default. Check whether your application turns it on.

Status as of 27 October 2026: what we know about attacks

No real-world attacks are known so far. As of 27 October 2026, the US agency CISA has not added the flaw to its catalogue of known exploited vulnerabilities (KEV), and Palo Alto is not aware of any exploitation. The fixes are out, though, so there is no reason to delay the update.

Why flaws like this keep coming back

Last week PHP2Shell, now Broccoli2Shell. Critical flaws in core libraries appear regularly. What matters is whether someone knows what your application runs on and can update it safely.

At 1. Web IT, based in Prague and Brno, we develop web applications and online shops and support them over the long term. As part of our application support or server and infrastructure management, we will go through your versions with you and help with the update. What good support should include is covered in our article on application support SLAs. If nobody has looked after your application since your previous vendor left, see our article on taking over an application from another vendor.

Is your website looked after by a friend who “knows computers”? Plenty of business websites and applications are kept running by a helpful friend, a former colleague or whoever happened to be nearby. That is perfectly normal, but it often means nobody has touched the server for a long time. If that sounds familiar, get in touch. We will take a look together at what your site runs on and whether everything is up to date.

Frequently asked questions

What is Broccoli2Shell?

Broccoli2Shell, also known as Node2Shell, is CVE-2026-111497, a vulnerability in Google's Brotli compression decoder. Crafted data can make the decoder write outside its allocated memory while unpacking. This can lead to a crash, a memory disclosure or even remote code execution. Google rates it 9.2 out of 10 (CVSS 4.0).

Does Broccoli2Shell affect my website?

If your website or application runs on Node.js, Python with the brotli package, PHP with the brotli extension, or sits behind a Palo Alto firewall with Brotli inspection, most likely yes. In our assessment, a typical PHP website on Apache or nginx is probably fine. Only a check of the actual versions by your vendor or hosting provider will tell you for sure.

How can I protect against Broccoli2Shell?

Update to the patched versions, for example Node.js 22.23.4, 24.22.1 or 26.12.1 and Python brotli 1.2.1. Then restart processes and rebuild containers. Node.js 20 and older will not get a fix, so you need to move to a newer version.

Is Broccoli2Shell being exploited?

As of 27 October 2026, no real-world attacks are known and the flaw is not in the CISA KEV catalogue. Fixes are available, so do not delay the update.

Not sure what runs on your server, or did the update run into a problem? Get in touch and we will go through your versions and update steps with you.