Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more

Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault 7r83qic5), page us/research/broccoli2shell-com/broccoli2shell-com, snapshot 20261027T191336Z. Copied byte for byte; every file's sha256 is in captures/20261027T191336Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Read in the curator's role._

broccoli2shell.com, a site about CVE-2026-111497 in Google's Brotli C decoder (no author or publisher named on the captured page): affected and fixed versions of Brotli, Node.js, Python packages, and PAN-OS.

> Brotli decoder 1.0.3 through 1.2.0. An out-of-bounds write that can lead to a crash, a memory leak or remote code execution. Rated 9.2 Critical (CVSS 4.0) by GitHub, High by Node.js.

> Google Brotli (C library) 1.0.3 – 1.2.0 1.0.10, 1.1.1, 1.2.1

Why it is here

From the promotion queue (index/promote.json, priority 2): broccoli2shell.com: CVE-2026-111497, an out-of-bounds write in the Brotli C decoder 1.0.3 to 1.2.0 (9.2 Critical, CVSS 4.0), affecting Node.js, Python and others; notes PAN-OS 11.2 to 12.2 with Brotli inspection affected.

Supports: the related Brotli flaw (CVE-2026-111497): scope and fixed versions; board breaking-0002.

Capture notes

Language en. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:21Z. The page describes the decoder bug at code level; that detail is left in the capture and not repeated here.