Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
Summary
A detailed write-up about a critical vulnerability in the Brotli decoder (CVE-2026-111497) that can cause out-of-bounds writes, crashes, memory leaks, or remote code execution across Node.js, Python, and other runtimes that bundle Google's Brotli decoder. The article lists affected versions, fixes, upgrade guidance, and potential exploitation status, emphasizing the need to update across ecosystems and to restart/redeploy properly.