Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more(broccoli2shell.com)
384 points by theanonymousone | 200 comments
Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.