CVE-2026-111497 — Broccoli2Shell

In October 2026, CVE-2026-111497 was announced, also known as "Broccoli2Shell". See for example the Tenable FAQ for more information.

This is a critical heap out-of-bounds write in the Brotli decompression library's C decoder, triggered by crafted compressed input. Exploitation requires that the target decompresses attacker-controlled Brotli data, which is most commonly the case in Node.js and other runtimes that handle Brotli-compressed requests.

Impact to LiquidFiles

Does this impact LiquidFiles — No.

LiquidFiles does not use Node.js, and Node.js has not been installed on the LiquidFiles appliance since v4.3.0. The Node.js runtime is the primary attack vector for this vulnerability, so there is no such code path in LiquidFiles.

The Ubuntu libbrotli1 library is still installed on the LiquidFiles system, as it is a dependency of other system packages. On systems with automatic system updates enabled, the fixed version of the library (libbrotli1 1.0.9-2ubuntu0.1) is installed automatically from the Ubuntu repositories.

What you should do

Make sure that automatic system updates are enabled on your LiquidFiles system, which is the default. If you have disabled them, run a system update to install the fixed libbrotli1 package. You can verify the installed version from the console with:

dpkg -l libbrotli1

No LiquidFiles update is needed to address CVE-2026-111497.