A library with a reference implementation of the Brotli data compression format decoder has been identified with a vulnerability (CVE-2026-111497, codenames Broccoli2Shell and HTTP2Shell), leading to a buffer overflow when processing specially formatted compressed data. According to data Google, the vulnerability can be used for remote code execution when attacking projects that use the official implementation of the Brotli decoder. Among the projects affected by the vulnerability: Node.js, Bun, Envoy, Istio, web browsers, proxy servers, HTTP clients, HTTP servers, archivers, proxy servers, UEFI firmware, JPEG XL viewers, content decoding libraries for Python, Ruby, Java, PHP and .NET and related dependencies.
The problem was identified by OpenAI in February this year year and blocked in the Brotli codebase by discarding invalid streams during decoding. On October 22, corrective releases of Brotli 1.0.10, 1.1.1 and 1.2.1 were published in which it was explicitly stated that the vulnerability was eliminated and the essence of the problem was corrected. On the same day, an exploit prototype was created, which made it possible to remotely execute the code in a laboratory setting, using non-standard assemblies (crashes occurred in standard assemblies). Later, Imperva recorded an attack on standard builds of Node.js 24.22.0 in a Linux environment on an ARM64 system.
The vulnerability leads to an out-of-bounds write due to incorrect error handling during the parsing of blocks in a compressed stream. The DecodeBlockTypeAndLength() function returned only true and false instead of an error code, which did not allow the calling code to distinguish between thread corruption and a condition that required passing additional data to the function. If an incorrect type of compressed data block was specified in the stream, the decoder perceived it not as an error, but as a state of lack of data, requiring additional reading from the stream. But since the allocated buffer was not designed for additionally read data, they were written to an area outside of it, in which the internal state of the decoder was stored.
Projects affected by vulnerabilities:
- Reference library brotli, the problem appears since release 1.0.3 and was fixed in updates 1.0.10, 1.1.1 and 1.2.1. The vulnerability affects applications and libraries that use the libbrotlidec library.