Google Brotli flaw leaves 90% of the cloud exposed, Wiz finds, as patching scramble continues
Patches are now rolling out across the internet's plumbing as the evil green wreaks havoc
Image by cybernews
Follow us
- Wiz found 91% of cloud environments contain resources vulnerable to the Brotli flaw.
- The issue affects Node.js, Microsoft .NET, Mozilla Firefox, Thunderbird, and several Linux systems.
- Test attack code can crash software, but Red Hat has not seen reliable public code for remote takeover.
- Companies should patch public-facing services first and disable Brotli handling for untrusted compressed data if needed.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A flaw found in Node.js has turned into a much bigger mess – now hitting Microsoft, Mozilla, and major Linux systems.
New research from cloud security firm Wiz reveals that 91% of cloud environments contain resources vulnerable to CVE-2026-111497, a dangerous flaw in Google’s widely-used Brotli compression technology.
One of the affected technologies is Node.js, the popular JavaScript runtime that helped bring the vulnerability to light.
The flaw – initially dubbed Node2Shell, is now being called Broccoli2Shell – for no other reason, it would seem, that Brotli sounding similar to the vegetable "broccoli” – or, if that moniker doesn't float your boat then, “HTTP2Shell.”
Wiz also found that 82% of cloud environments have Node.js systems exposed directly to the internet.
Netflix, PayPal, Walmart, LinkedIn, Uber, and even NASA all rely on Node.js for parts of their online services.
In practice, that means online stores, streaming services, banking apps, and countless company websites could all be running on vulnerable infrastructure without realizing it.
The good news, according to a Wix report published Monday, is that patches are now rolling out across the internet's plumbing – from developer tools like Node.js and Bun, to Microsoft's .NET platform and Linux systems (Debian, Alpine, Amazon Linux) that quietly run much of the web.
However, Ubuntu and SUSE – two widely used Linux systems that power many business and cloud servers – still don't have a fix available, and Red Hat, another major Linux provider, has only partially patched the issue so far.
Mozilla Firefox and Thunderbird also affected
In an updated advisory published on Monday, Red Hat confirmed that Mozilla Firefox and Thunderbird are among the applications potentially affected, alongside Node.js and web servers processing Brotli-compressed traffic.
Red Hat says public proof-of concept exploits can trigger memory corruption and crashes, but no reliable public remote code execution exploit has yet been observed.
Public proof-of-concept code exists that demonstrates memory corruption and crash (denial of service); no public, reliable exploit for remote code execution has been observed,”notes Red Hat's executive summary, published Monday.
Microsoft has also issued security updates for .NET, though it clarified that the older .NET Framework is unaffected, and that ASP.NET Core and HttpClient don't use Brotli decompression by default.
Why Node.js flaw is bigger than first thought
As Cybernews reported on Friday, Node.js patched 10 security vulnerabilities last week, including a serious Brotli decoder flaw that could potentially allow attackers to execute malicious code remotely.
The bug was reportedly discovered by OpenAI's security team who say their AI tools flagged the bug while testing OpenAI's own systems – and fixed by Node.js developers Matteo Collina and Antoine du Hamel.
Ron Masas of Imperva's security team then proved the bug could actually be exploited, while researchers at OpenSourceMalware and Aikido studied how it affected Python software.
The underlying issue lies in Brotli, Google’s open-source compressor, used to make web traffic smaller and faster.
Attackers can exploit the bug by tricking vulnerable software into decompressing malicious data – potentially exposing sensitive information, crashing applications, or running harmful code.
No login or credentials are needed – the attack works as long as the vulnerable software processes compressed data from an attacker.
What should orgs do now?
The flaw emerged towards the end of last week, when attention was focused on separate PHP vulnerabilities, dubbed PHP2Shell.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Wiz warns that vulnerable components are widespread across Kubernetes clusters, cloud applications, API gateways, and containerized services.
Companies should first patch internet-facing services handling untrusted Brotli data, then rebuild affected containers and check other software for bundled, outdated Brotli copies.
Where no fix is available yet, turning off Brotli decompression for untrusted data can reduce the risk.
