started · updated
Brotli compression library vulnerability affects Node.js and Python
A critical security vulnerability, identified as CVE-2026-111497 and nicknamed ‘Broccoli2Shell’, has been discovered in the Brotli decompression library. The flaw originates from an out-of-bounds write error in the upstream Brotli C decoder when handling specially crafted compressed data during block-processing operations.
With a CVSS score of 9.2, the vulnerability allows unauthenticated remote attackers to trigger memory corruption. Potential consequences include sensitive information disclosure, application crashes, and remote code execution (RCE). The issue impacts a wide range of technologies that utilize the library for data decompression, including Node.js, Bun, Envoy Proxy, Istio, and various Python applications.
Google has released patched versions of Brotli, specifically v1.2.1, v1.1.1, and v1.0.10. Affected downstream environments such as Node.js and Bun have also issued security updates to mitigate the risk. Researchers from OpenAI Codex Security, including Khai Tran and Sylvie Mayer, were credited with discovering the flaw.
Entities
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] The vulnerability is tracked as CVE-2026-111497. it-administrator.de · gigazine.net
- [○ 1 SOURCE] The vulnerability has a CVSS score of 9.2. it-administrator.de
- [○ 1 SOURCE] Google released patched Brotli versions v1.2.1, v1.1.1, and v1.0.10. gigazine.net
- [● 2 SOURCES] Affected technologies include Node.js, Bun, Envoy Proxy, and Istio. gigazine.net
- [● 2 SOURCES] Python applications are also affected by the vulnerability. it-administrator.de
- [● 3 SOURCES] Exploitation can lead to remote code execution (RCE). it-administrator.de · gigazine.net
- [○ 1 SOURCE] Khai Tran and Sylvie Mayer of OpenAI Codex Security discovered the vulnerability.
- [● 2 SOURCES] The flaw is an out-of-bounds write vulnerability in the Brotli decoder. it-administrator.de