Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)
broccoli2shell.com
An out-of-bounds write in Google's Brotli decoder reaches Node.js, Python and more. Affected versions, checks and fixes.

cross-posted from: https://nord.pub/c/technology@lemmy.world/p/497144/broccoli2shell-the-brotli-decoder-bug-cve-2026-111497-affecting-node-js-python-c-library

CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.