Broccoli2Shell: The One Decoder We All Depend On

semgrep.dev

1 pointj12y2 comments

Brotli is bigger than node2shell, php2shell or an npm bug. Its copied into runtimes, databases, document readers, image libraries, language bindings, and native packages. (CVE-2026-111497)

Are you unaware that Node2Shell (cve-2026-111497) got renamed to Broccoli2Shell (reason unjustified)? It's not bigger.

Node2Shell = cve-2026-111497 (14 points, 5 days ago) https://news.ycombinator.com/item?id=50203180

Broccoli2Shell (402 points, 4 days ago, 219 comments) https://news.ycombinator.com/item?id=50219177

Reply on news.ycombinator.com