Broccoli2Shell

broccoli2shell.comDR 9 Accessible 300 views

News & Rankings Broccoli2Shell is a security advisory site for CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder affecting Node.js, Python Brotli and brotlicffi.

Visit now Favorite

Editor's Review

For reference only

The site is a focused single-vulnerability resource rather than a general CVE database, which makes it fast to scan during incident response. Its version tables map each affected product line to a fixed release, and it flags end-of-life Node.js branches that will never receive a patch. The reminder

Site introduction

Broccoli2Shell documents CVE-2026-111497, a memory-safety flaw in Google’s Brotli decoder that permits crafted compressed data to write past the end of a buffer. The site frames the issue as a recall notice: decoder versions 1.0.3 through 1.2.0 are affected, with outcomes ranging from crashes and memory leaks to remote code execution. GitHub rates it 9.2 Critical under CVSS 4.0, while Node.js classifies it as High.

The core of the page is a remediation matrix. Each product line is paired with the release that fixes it: Google Brotli C library 1.0.10, 1.1.1 and 1.2.1; Node.js 26.12.1, 24.22.1 and 22.23.4; Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Node.js 25, 23, 20 and older receive no fix at all, and the site directs users on those end-of-life lines to migrate to 22, 24 or 26.

Beyond version numbers, the advisory stresses operational follow-through. Installing an update does not protect a process that is already running, because it retains the old decoder until restarted. Containers need their base image rebuilt on a patched foundation and redeployed. Separate sections cover who is exposed, bundled copies of the decoder inside other software, how to check, and the exploitation timeline.

This resource suits backend and platform engineers, security responders and maintainers who ship Node.js or Python services with Brotli compression enabled. It is also useful for anyone auditing dependencies that vendor the C decoder. Readers should confirm their exact runtime and library