CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
Installing the update isn’t enough. A running process keeps the old decoder until it restarts
Yes, that’s kinda how computers work?
Imo still worth reminding people that just because you run an
apt/dnf upgraderunning applications still map the now unlinked outdated version.Sure, but good reminder anyway.
Craziest 7 days
yet.
For Nginx on Debian, I need to figure out if just updating the
libbrotli1package is sufficient, or iflibnginx-mod-http-brotlineeds to be updated too. I suspect it’s dynamically linked (since that’s standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.
