Which Services Need A Restart After The Broccoli2Shell Patch?

🔍 Read the full analysis: Which Services Need A Restart After The Broccoli2Shell Patch? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Broccoli2Shell, a memory-corruption flaw in Google’s Brotli decoder, has fixes in several runtimes and packages, but operators must restart affected running processes after updating for them to load the patched code. The issue, identified as CVE-2026-111497, affects decoder versions 1.0.3 through 1.2.0 and can reach software that uses Brotli to decompress web responses, request bodies or files.

The practical rule is to patch the component that supplies Brotli, then restart every running process that uses it. A package or operating-system update does not replace code already loaded into a service’s memory. The source report does not name a single restart command or a universal list of services: the affected process depends on how each system is built and where it gets its Brotli decoder.

Fixed releases listed in the report include Node.js 22.23.4, 24.22.1 and 26.12.1; Node.js 20, 23 and 25 are listed as having no fix. Python’s Brotli package is fixed in 1.2.1, and brotlicffi in 1.2.1.0. The report also lists Bun 1.4.4, several Envoy and Istio releases, .NET runtime releases, and Debian package updates. Those version numbers are dated to the report’s October 26 status and should be checked against current vendor advisories before deployment.

Potentially affected processes include applications that automatically decompress Brotli-encoded responses, services that accept and inflate compressed request bodies, and tools that decode Brotli-compressed files. The report cites Node’s built-in fetch and Python HTTP clients as examples of response handling. It says Express and body-parser versions in specified ranges can inflate Brotli request bodies, but stresses that the flaw is in the decoder, not Express itself. Updating Express alone is not a fix. A bare Node.js HTTP server, it says, does not decode request bodies automatically.

Which Processes Need Restarting

The restart requirement matters because patching files on disk is not the same as replacing code in a live process. A long-running Node.js server, Python application, proxy or other service may continue using the old decoder until it is restarted. The source report gives no universal service list; teams need to identify which deployed processes load an affected Brotli copy and confirm they are running a fixed build after maintenance.

The reported flaw can cause a crash or memory corruption when a decoder processes crafted compressed input. The report says memory disclosure or code execution could be possible in the worst case, and cites a demonstration by Imperva that ran code on an unmodified official Node.js image after several attempts. That demonstration is not the same as evidence of attacks in the wild: the report says CISA data listed exploitation as “none” and the CVE was not in the agency’s Known Exploited Vulnerabilities catalog at the time.

The breadth of software using Brotli complicates response. An organization may have direct dependencies, system libraries, or bundled copies inside runtimes and tools. The relevant fix can differ by deployment: official Node.js builds bundle Brotli, while some Linux distributions build Node.js against a system library. Teams should verify the actual package and build source, rather than assume that upgrading one shared library—or one application framework—covers every process.

How Brotli Reached Multiple Stacks

Brotli is a compression format used to reduce the size of data sent over networks and stored in files. Applications rely on a decoder to unpack that data. According to the source report’s account of the Node.js advisory, the decoder mishandled malformed input by treating it as data that needed more input rather than as an invalid stream. It could then write beyond an internal eight-byte buffer. The vulnerability record identifies an out-of-bounds write and an unchecked return value.

The report says the underlying source change was committed on February 27, 2026, but did not describe the issue as a security fix at the time. Releases containing the fix appeared on October 21, a gap the report calculates as 236 days. The CVE became public on October 22, the same day a public proof of concept appeared, according to the article’s cited tracker. Fixes then had to move from the Brotli library into dependent runtimes, packages, distributions and deployed images.

As of October 26, the article’s tracker listed more than 30 projects or packages that bundle their own Brotli copy, with seven still listed as unfixed, including DuckDB, Apache Arrow’s bundled build, 7-Zip-zstd, p7zip and EDK II firmware tools. The report also notes that a Python package advisory was missing from some advisory databases on October 23 before GitHub added it later that day. Those details show why dependency scanning and patch status can lag behind upstream releases.

Remaining Exposure and Exploitation

The source report says there was no recorded exploitation in the wild as of October 26, 2026, but that status can change and does not establish that every vulnerable system is safe. It does not provide a complete inventory of affected deployments or confirm that all operators have patched and restarted their services.

Some bundled copies were still listed as unfixed, while other projects had fixes only in their main development branches. The report does not establish when each remaining project will publish a release, which installed versions are in use, or whether a particular deployment accepts attacker-controlled compressed data. Exposure depends on the software, configuration and data paths involved.

Operators should also verify release details with the relevant maintainers. The listed versions reflect the source article’s status date, and distribution packaging or backported fixes may not match upstream version numbers. A system can have a security fix under a distribution-specific package version, or remain exposed despite an apparently updated application if it uses a separate bundled decoder.

Verify Fixes Across Deployments

Organizations should inventory runtimes, packages, proxies and file-processing tools that use Brotli, then compare each installed build with its vendor’s advisory. After installing an applicable fixed release, operators should restart the processes that load the decoder and verify that new processes are running the patched version. Container users should rebuild or replace images as needed and confirm that old instances have been removed from service.

Teams should separately check whether a component bundles Brotli or uses a system library; the distinction affects which update applies. Where a project has not yet published a fixed release, its advisory or tracker should be monitored for a supported update. The source report does not specify a single deadline or remediation sequence for all affected products, so follow the instructions from each runtime, distribution and project maintainer.

The next developments are likely to be further package and distribution releases, plus updated inventories of remaining bundled copies. Until those are confirmed, the reported October 26 list is a dated snapshot rather than proof that every affected product has been accounted for.

Key Questions

Which services should be restarted after the Broccoli2Shell patch?

Restart running processes that use an affected Brotli decoder after updating that decoder or its supplying runtime or package. Examples can include Node.js and Python applications, proxies such as Envoy, and file-processing tools, depending on their build and configuration. The report does not provide a universal list of service names.

Is updating Express enough to fix the vulnerability?

No. The source report says the flaw is in the Brotli decoder, not Express. It identifies some Express and body-parser versions that inflate Brotli request bodies, but says upgrading Express alone does not replace a vulnerable decoder. Check and update the underlying runtime or Brotli package, then restart the affected process.

What fixed Node.js versions are listed?

The report lists Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. It says Node.js 20, 23 and 25 do not receive a fix. These details reflect the report dated October 26, 2026; verify the current Node.js security advisory before acting.

Has Broccoli2Shell been exploited in the wild?

The source report says CISA data listed exploitation as “none” and the CVE was not in CISA’s Known Exploited Vulnerabilities catalog as of October 26, 2026. It also describes an Imperva code-execution demonstration on an unmodified Node.js image, which is a demonstration rather than confirmation of real-world attacks.

Why is a restart needed after installing the fix?

A running service can keep using the decoder already loaded in memory even after package files have been updated. Restarting the affected process loads the updated code. Operators should verify the process is running a fixed build after restarting.

Source: ThorstenMeyerAI.com