Broccoli2Shell

Security researchers have disclosed a critical flaw in the Brotli compression decoder, a library built into countless applications. The bug, dubbed Broccoli2shell by Wiz, enables remote code execution and is not limited to Node.js — it also affects Bun, Python and other widely used software. German outlet Golem.de warns that attacker code execution is possible across numerous applications. Developers are urged to patch dependent runtimes and packages.

Security researchers have disclosed a critical vulnerability in the Brotli compression library's decoder, dubbed Broccoli2shell. Brotli is built into browsers, web servers and countless applications, so the flaw could affect a huge share of internet infrastructure. Guides explaining the issue and how to patch it are spreading among developers, and searches about Brotli are surging in the UK, Russia, Germany and Japan.

A vulnerability dubbed Broccoli2Shell allows remote code execution through the Brotli decompression library, affecting Node.js, Python and other software that bundles affected decoder implementations. Any service accepting compressed input could potentially be exploited by attackers sending crafted Brotli streams. Developers are being urged to check whether their dependencies ship vulnerable decoder code and to apply patches as they become available.

Newly disclosed vulnerabilities in Brotli decoder implementations have been given names including Node2Shell, Broccoli2Shell and HTTP2Shell, suggesting the flaws could allow attackers to achieve remote code execution in environments that parse Brotli-compressed data. Brotli is a compression format widely used across web servers, browsers and developer tooling, so affected libraries are broadly deployed. Esri has published an advisory referencing the issues, and security teams are checking whether their products embed vulnerable decoder code.

The exploit tools php2shell and broccoli2shell are reportedly cutting a swath of devastation through IT landscapes, with security-focused commentators drawing parallels to a classic warning from C.J. Date's 1964 Database Handbook: things initially dismissed as 'only theoretical' have a nasty habit of becoming real problems. The discussion highlights how once-theoretical attack techniques are now being actively weaponised against systems in practice.

A critical vulnerability in the Brotli compression library's decoder has been disclosed under the name Broccoli2shell, according to security researchers at Wiz. Brotli is widely built into browsers, servers and applications, so a flaw in its decoder could allow attacks on a huge range of software. Security teams are discussing which versions are affected and when patches land.

A new critical vulnerability, CVE-2026-111497 with a CVSS score of 9.2, is drawing attention after reports of an out-of-bounds write in Google's Brotli decoder affecting Node.js and Python Brotli implementations, dubbed 'broccoli2shell'. It follows the recent 'PHP2Shell' flaw, frustrating security teams who had just finished patching that issue. Fixed versions reportedly include Node 22.23.4, 24.22.1, 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The bug was reported via OpenAI's Codex security research.

Security professionals are warning each other about a newly disclosed high-severity vulnerability, CVE-2026-111497, dubbed Node2Shell or Broccoli2Shell. It is an out-of-bounds write flaw in the Brotli compression decoder, and system administrators are bracing for remediation work, comparing it to a recent painful PHP vulnerability.