Brotli

AltTabDaily posts tagged Brotli, newest first.

CybersecurityOct 29, 2026
Node2Shell (CVE-2026-111497): am I affected, and which versions fix it?
CISA added the Brotli decoder bug CVE-2026-111497 (Node2Shell / Broccoli2Shell / HTTP2Shell) to its Known Exploited Vulnerabilities catalog on 27 Oct 2026, with a 10 Nov federal due date. Run node --version and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later.
CybersecurityOct 26, 2026
Broccoli2Shell: a Brotli decoder bug (CVE-2026-111497) puts Node.js, Bun, Envoy and Python on the patch list
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 4.0 9.2 from the CNA) can be triggered by crafted compressed data. Fixed Brotli, Node.js, Bun, Envoy, Istio and Python releases shipped 21–23 Oct 2026.

Node2Shell (CVE-2026-111497): am I affected, and which versions fix it?