search
Broccoli2shell
Trends
- 1Brotli decoder flaw enables remote code execution across major runtimes●Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
A vulnerability dubbed Broccoli2Shell allows remote code execution through the Brotli decompression library, affecting Node.js, Python and other software that bundles affected decoder implementations. Any service accepting compressed input could potentially be exploited by attackers sending crafted Brotli streams. Developers are being urged to check whether their dependencies ship vulnerable decoder code and to apply patches as they become available.
- 2
Security researchers are warning about CVE-2026-111497, a critical vulnerability affecting the Brotli decompression library. Analysis published under the name 'Broccoli2shell' describes how attackers could exploit flaws in the Brotli decoder, potentially leading to remote code execution. The issue is drawing interest across multiple countries as organisations assess whether their systems use the affected library.
- 3
A critical vulnerability in the Brotli compression library's decoder has been disclosed under the name Broccoli2shell, according to security researchers at Wiz. Brotli is widely built into browsers, servers and applications, so a flaw in its decoder could allow attacks on a huge range of software. Security teams are discussing which versions are affected and when patches land.
- 4Broccoli2shell: Critical Vulnerability Found in Brotli Decoder●Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Security researchers have disclosed Broccoli2shell, a critical vulnerability affecting the Brotli decompression library, which is widely embedded in browsers, servers and software stacks to compress web traffic. The flaw could allow attackers to crash applications or execute code on systems processing maliciously compressed data. Because Brotli ships by default in Chrome, Node.js and many other products, defenders are being urged to patch affected components quickly and check for exposed versions.
- 5New Brotli decoder vulnerability alarms security teams●Oh man, light a candle for # infosec , # sysop , and # ops , cause if you thought the # php # cve was fun, wait till you
Security professionals are warning each other about a newly disclosed high-severity vulnerability, CVE-2026-111497, dubbed Node2Shell or Broccoli2Shell. It is an out-of-bounds write flaw in the Brotli compression decoder, and system administrators are bracing for remediation work, comparing it to a recent painful PHP vulnerability.