Get the latest tech news

Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more


An out-of-bounds write in Google's Brotli decoder reaches Node.js, Python and more. Affected versions, checks and fixes.

None

Get the Android app

Or read this on r/technology

Read more on:

Photo of RCE

RCE

Photo of python

python

Photo of Node.js

Node.js

Related news:

News photo

Parsing EDIFACT in Python with syntax trees

News photo

Evolving Threat: http2shell is an RCE in Node, Python, and more

News photo

Abandoned Popcorn Time app exposed millions of devices to RCE attacks