CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
For Nginx on Debian, I need to figure out if just updating the
libbrotli1package is sufficient, or iflibnginx-mod-http-brotlineeds to be updated too. I suspect it’s dynamically linked (since that’s standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.