{
  "id": 16496390,
  "title": "Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more",
  "url": "https://urgent.news/2026/10/24/broccoli2shell-brotli-decoder-rce-in-node-js-python-and-more",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T08:06:39.000Z",
  "source": {
    "name": "Hacker News Best",
    "slug": "hacker-news-best",
    "url": "https://broccoli2shell.com/"
  },
  "original_language": "en",
  "account": "The Brotli decoder in Node.js versions 1.0.3 through 1.2.0 contains a critical vulnerability that can lead to a crash, memory leak, or remote code execution. This issue is not limited to Node.js, as Python frameworks and middleware that decode Brotli-encoded data are also affected. An attacker can send a maliciously crafted Brotli stream to a vulnerable server, which can then trigger an unchecked return value in the decoder, leading to memory corruption or code execution. The vulnerability exists due to the decoder's inability to differentiate between malformed streams and those requiring more input, causing it to write past an eight-byte internal buffer. The fix involves returning a hard format error to the caller, preventing the exploitation of the flaw. However, many projects ship their own copy of the C decoder, meaning that a distribution update may not be sufficient to protect those applications. It is crucial to update all affected libraries and services, including Node.js, Bun, Chromium, Firefox, brotlicffi, ngx_brotli, Brotli4j, SumatraPDF, Ghostscript, CatBoost, YTsaurus, and Gentoo, Solus, and VMware Photon packages.",
  "summary": "https://www.aikido.dev/blog/python-packages-vulnerable-node2... Comments URL: https://news.ycombinator.com/item?id=50219177 Points: 362 # Comments: 180",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Node.js patched a code-execution Brotli bug October 21",
        "url": "https://urgent.news/2026/10/23/node-js-patched-a-code-execution-brotli-bug-october-21",
        "published": "2026-10-23T22:25:39.000Z"
      },
      {
        "outlet": "Lobsters",
        "title": "This week's \"node2shell\" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli",
        "url": "https://urgent.news/2026/10/24/this-weeks-node2shell-brotli-vulnerability-cve-2026-111497-is",
        "published": "2026-10-24T11:01:27.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}