Update: Brotli flaw exposure expands

Threat summary

Analysis following the disclosure of CVE-2026-111497 (also referred to as Brotli2Shell, Broccoli2Shell, Node2Shell, and HTTP2Shell) has expanded the list of products affected by the vulnerable Google Brotli decoder and improved understanding of where exploitable attack paths may exist.

Early reporting focused primarily on software ecosystems known to bundle the decoder, including Node.js, .NET, Python, Envoy, Istio, and Bun.

Between October 24 and 27, additional vendor advisories identified affected:

• Versions of Palo Alto PAN-OS

• Prisma Cloud Application Security Transporter Client

• PowerShell 7.4, 7.5, and 7.6

• Visual Studio 2019, 2022, and 2026

• The Red Hat Enterprise Linux 9 Brotli package

Investigations also identified vulnerable bundled Brotli implementations in projects including ClickHouse, DuckDB, Apache Arrow, MuPDF, NanaZip, GraalJS, and libjxl.

JPEG XL and FFmpeg

One of the most significant findings involves libjxl, the reference implementation of the JPEG XL image format, which uses Brotli to decompress metadata embedded in JPEG XL files.

Research published on October 25 demonstrated that a specially crafted JPEG XL image could reach the vulnerable Brotli decoder when processed by an affected FFmpeg deployment. Researchers demonstrated memory corruption and instruction-pointer control within FFmpeg, showing that the vulnerability can be reached through file-processing workflows rather than network traffic alone. This expands potential exposure beyond web applications to any system that processes untrusted JPEG XL content.

Other product impacts

The same research showed a remote crash in ClickHouse from a single malicious request, a crash in the .NET runtime, and an infinite loop in Apache Arrow that results in denial of service.

Infrastructure impacts

Palo Alto PAN-OS is affected when both TLS decryption and Brotli inspection are enabled. Brotli inspection is disabled by default and is available beginning with PAN-OS 11.2.4.

Affected releases include vulnerable 11.2.4 and later 11.2 builds, along with affected 12.1 and 12.2 releases prior to available hotfixes.

PAN-OS 11.1, 10.2, Panorama, and the management interface are outside the scope of the issue. Envoy and Istio deployments are affected only when Brotli decompression has been explicitly configured.

Exploitation reporting

On October 26, a single threat intelligence source reported observing an exploitation attempt targeting Node.js 24.22.0 on x86-64 systems.

Independent confirmation of the reported activity has not been published.

Analysis

Node.js remains the most exposed software ecosystem identified to date. Public proof-of-concept code, researcher demonstrations, and the only publicly reported exploitation attempt have all focused on Node.js deployments. Researchers demonstrated code execution against Node.js 24.22.0 under specific conditions, and subsequent reporting identified attack paths involving both Brotli-compressed request bodies and applications that retrieve Brotli-compressed content from external sources.

The most important development since disclosure is a better understanding of where the vulnerable decoder is reachable beyond Node.js and traditional web application attack paths. Early response efforts focused on internet-facing applications because the initial research demonstrated exploitation through Brotli-compressed HTTP traffic.

More recent findings show that exposure can also exist in file-processing workflows, content transformation services, media-processing infrastructure, analytics platforms, and security devices that inspect compressed traffic.

This shift matters because many organizations may have assessed their web applications while overlooking systems that automatically process externally supplied content. The FFmpeg and libjxl path shows that attacker-controlled data can reach the vulnerable decoder without Brotli-compressed web traffic, and the crash conditions in ClickHouse, .NET, and Apache Arrow widen the range of affected workflows further.

The growing list of affected products reinforces the need to identify where Brotli decompression occurs rather than focusing on a specific vendor or product family. Systems that process externally supplied files, retrieve compressed data from third-party services, or inspect Brotli-compressed traffic warrant review. Assessments limited to internet-facing web servers may miss vulnerable code embedded in supporting infrastructure, analytics platforms, and content-processing workflows.

Mitigations

Identify FFmpeg deployments and any other software that decodes JPEG XL images through libjxl. Rebuild affected software against Brotli 1.2.1 or a libjxl build that contains the fix. Until updates are available, limit processing of untrusted JPEG XL images.

Verify whether Brotli inspection and TLS decryption are both enabled in PAN-OS, and whether Brotli decompression is configured in Envoy and Istio, since these require specific settings before the vulnerable path is reachable.

Move to vendor-fixed releases, including Palo Alto PAN-OS hotfixes, Prisma Cloud Application Security Transporter Client 0.2.9, PowerShell 7.4.22, 7.5.13, and 7.6.9, Visual Studio 2019, 2022, and 2026 security releases, MuPDF 1.28.0, and the fixed Red Hat Enterprise Linux 9 Brotli package. Rebuild or redeploy any application that bundles its own copy of the Brotli decoder, since updating operating system Brotli packages alone may not remediate bundled implementations.

Monitor for application crashes, new core dumps, unusual file-processing failures, unexpected service restarts, and abnormal Brotli decompression activity. Investigate connected systems, credentials, and service accounts if compromise is suspected.

Known to be affected

Runtimes and application platforms

• Google Brotli C decoder, versions 1.0.3 through 1.2.0
• Node.js 22.x below 22.23.4
• Node.js 24.x below 24.22.1
• Node.js 26.x below 26.12.1
• Node.js 25.x, 23.x, 20.x, and older release lines (end of life)
• Bun before 1.4.4
• .NET 8.0, 9.0, and 10.0 releases before 8.0.33, 9.0.22, and 10.0.14, and .NET 11 previews before 11.0.0-rc.3
• .NET source builds from the public GitHub branches, as of October 26, 2026
• PowerShell 7.4, 7.5, and 7.6 before the October 25, 2026 updates

Python ecosystem

• Python Brotli 1.0.3 through 1.2.0
• Python brotlicffi 1.0.3 through 1.2.0.2

Developer tools

• Visual Studio 2019, 2022, and 2026 before the October 25, 2026 updates

Network and infrastructure products

• Envoy 1.39.2, 1.38.5, 1.37.7, and 1.36.11 when the Brotli decompressor is configured
• Istio releases before 1.29.9, 1.30.6, and 1.31.2 when Brotli decompression is enabled through an Envoy filter
• Prisma Cloud Application Security Transporter Client before 0.2.9
• Palo Alto PAN-OS (PA-Series and VM-Series firewalls) when both TLS/SSL decryption and Brotli inspection are enabled:
  • 12.2 before 12.2.4-h1
  • 12.1.10 before 12.1.10-h3
  • 12.1.7 before 12.1.7-h11
  • 12.1.4 before 12.1.4-h13
  • 11.2.16 before 11.2.16-h1
  • 11.2.13 before 11.2.13-h4
  • 11.2.4 before 11.2.4-h23
  • Not affected: PAN-OS 11.1, PAN-OS 10.2, Panorama, the management web interface, and the management API

Operating systems and packages

• Red Hat Enterprise Linux 9 brotli before 1.0.9-10.el9_8.1

Data platforms and analytics

• ClickHouse 26.10.2.103 and the 26.9, 26.8, and 26.3 LTS lines
• DuckDB (fix in progress)
• Apache Arrow bundled builds using Brotli 1.0.9

File processing, media, and document software

• MuPDF 1.27.x
• NanaZip 7.0.1873.0
• libjxl v0.12.0

Language engines and embedded components

• GraalJS 25.4.4.1.1
• Microsoft v8-jsi (Brotli 1.2.0)

Archive, compression, and firmware projects

• 7-Zip-zstd (Brotli 1.2.0)
• p7zip (Brotli 1.0.9)
• EDK II (Brotli 1.2.0)
• woff2 Makefile builds (Brotli 1.0.3)

Projects with no released fix available

• DuckDB
• Apache Arrow bundled builds
• Microsoft v8-jsi
• 7-Zip-zstd
• p7zip
• EDK II
• woff2 Makefile builds

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up