login sign up

Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)

broccoli2shell.com · first added by @mikem
saved by
1 person
discussions · 1
Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps 405 pts · 219 comments · Oct 2026 405 pts · 219 comments · Oct 2026
0 people saved or upvoted this
from the discussion · 6
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. aikido.dev aikido.dev
2 people saved or upvoted this
Bye Bye Brotli? Google's Compression Library Is a Security Mess bugsink.com bugsink.com
1 person saved or upvoted this
dropbox/rust-brotli: Brotli compressor and decompressor written in rust that optionally avoids the stdlib github.com github.com
0 people saved or upvoted this
HTTP2Shell Timeline bugsink.com bugsink.com
0 people saved or upvoted this
2029458 - Heap buffer overflow in BrotliDecoderDecompressStream via block_length[2] underflow with zero-output dictionary transforms bugzilla.mozilla.org bugzilla.mozilla.org
0 people saved or upvoted this
see all 6 →
brotli pypi.org pypi.org
0 people saved or upvoted this
related HN threads · 2
Bye Bye Brotli? Google's Compression Library Is a Security Mess 31 pts · 7 comments · Oct 2026 31 pts · 7 comments · Oct 2026
0 people saved or upvoted this
Evolving Threat: http2shell is an RCE in Node, Python, and more 186 pts · 95 comments · Oct 2026 186 pts · 95 comments · Oct 2026
0 people saved or upvoted this