Broccoli2Shell: Critical Brotli Flaw Puts Node.js and Other Web Tools at Risk

A critical vulnerability named Broccoli2Shell, tracked as CVE-2026-111497, has been found in the Brotli decompression library. Brotli is a common component used to shrink web traffic and other data. According to Wiz Research, the flaw affects several widely used technologies, including Node.js, Bun and Envoy Proxy. An unauthenticated remote attacker could trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE).

The problem is an out-of-bounds write in the Brotli decoder. When the software handles specially crafted compressed data, it can write beyond its allocated memory. An attacker who supplies malicious Brotli data to a vulnerable application could gain code execution with the privileges of that application. Researchers have demonstrated successful exploitation against unpatched Node.js environments. Although the issue was first linked to Node.js, it originates in the upstream Brotli C decoder, so other software that includes it may also be affected.

Exploitation requires an application or dependency to decompress attacker-controlled Brotli data. That could arrive through incoming web requests, externally fetched responses or other untrusted compressed content. Some HTTP clients and frameworks decompress automatically when Brotli support is enabled, so an application may be exposed even if its code never mentions Brotli. Organisations that decompress untrusted Brotli data are advised to prioritise remediation.