2026-10-26 07:59 UTC
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497) - Affecting Node.js, Python, C library
CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
Replies (3)
-
@UltraBlack@lemmy.world 2026-10-26 08:19
Craziest 7 days
-
@dan@upvote.au 2026-10-26 08:41
For Nginx on Debian, I need to figure out if just updating libbrotli1 on Debian is sufficient, or if libnginx-mod-http-brotli needs to be updated too. I suspect it’s dynamically linked (since that’s standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.
-
@pipe01@programming.dev 2026-10-26 09:05
Installing the update isn’t enough. A running process keeps the old decoder until it restarts Yes, that’s kinda how computers work?