Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 8 sources · 3 days · First seen 5 days ago · Last updated 3 days ago

Brotli compression library vulnerability

Overview

A critical security vulnerability, identified as CVE-2026-111497 and nicknamed ‘Broccoli2Shell’, has been discovered in the Brotli decompression library. The flaw originates from an out-of-bounds write error in the upstream Brotli C decoder when handling specially crafted compressed data during block-processing operations.

With a CVSS score of 9.2, the vulnerability allows unauthenticated remote attackers to trigger memory corruption. Potential consequences include sensitive information disclosure, application crashes, and remote code execution (RCE). The issue impacts a wide range of technologies that utilize the library for data decompression, including Node.js, Bun, Envoy Proxy, Istio, and various Python applications.

Google has released patched versions of Brotli, specifically v1.2.1, v1.1.1, and v1.0.10. Affected downstream environments such as Node.js and Bun have also issued security updates to mitigate the risk. Researchers from OpenAI Codex Security, including Khai Tran and Sylvie Mayer, were credited with discovering the flaw.

Entities

Node.js · Google · Python · Safetica · Qihoo 360

Claims

What the coverage asserts, and how many sources carry each claim.

[● 3 SOURCES] The vulnerability is tracked as CVE-2026-111497. cybernoz.com · it-administrator.de · gigazine.net
[● 3 SOURCES] Exploitation can lead to remote code execution (RCE). cybernoz.com · it-administrator.de · gigazine.net
[● 2 SOURCES] The flaw is an out-of-bounds write vulnerability in the Brotli decoder. cybernoz.com · it-administrator.de
[● 2 SOURCES] Affected technologies include Node.js, Bun, Envoy Proxy, and Istio. cybernoz.com · gigazine.net
[● 2 SOURCES] Python applications are also affected by the vulnerability. cybernoz.com · it-administrator.de
[○ 1 SOURCE] The vulnerability has a CVSS score of 9.2. it-administrator.de
[○ 1 SOURCE] Google released patched Brotli versions v1.2.1, v1.1.1, and v1.0.10. gigazine.net
[○ 1 SOURCE] Khai Tran and Sylvie Mayer of OpenAI Codex Security discovered the vulnerability. cybernoz.com

Timeline

3 days ago

[TECHNOLOGY] 6 sources
Brotli compression library vulnerability affects Node.js and Python
A critical vulnerability (CVE-2026-111497) in the Brotli compression library allows remote code execution in Node.js, Bun, and Python applications. Patches are now available.
5 days ago

[TECHNOLOGY] 2 sources
Cybersecurity threats evolve with BYOVD economy and Node.js vulnerability
Cybercriminals are industrializing BYOVD attacks to bypass EDR security, while a critical Node.js vulnerability named ‘Node2Shell’ allows for remote code execution via Brotli compression.

Sources

cert.ug · cybernoz.com · dev.to · drohnen.de · gigazine.net · ilcorrieredellasicurezza.it · it-administrator.de · turbolab.it