Spyke

Syndicated from the fediverse. Read and engage on the original instance.

Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497) - Affecting Node.js, Python, C library

CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google's Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.

https://broccoli2shell.com/Open link View original on nord.pub

Comments6

6 replies

pipe01

programming.dev

Installing the update isn't enough. A running process keeps the old decoder until it restarts

Yes, that's kinda how computers work?

Sir. Haxalot reply

nord.pub

Imo still worth reminding people that just because you run an apt/dnf upgrade running applications still map the now unlinked outdated version.

lnxtx (xe/xem/xyr) reply

sopuli.xyz

Sure, but good reminder anyway.

UltraBlack

lemmy.world

Craziest 7 days

lnxtx (xe/xem/xyr) reply

sopuli.xyz

yet.

dan

upvote.au

For Nginx on Debian, I need to figure out if just updating the libbrotli1 package is sufficient, or if libnginx-mod-http-brotli needs to be updated too. I suspect it's dynamically linked (since that's standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.