j12y··on Broccoli2Shell: The One Decoder We All Depend OnBrotli is bigger than node2shell, php2shell or an npm bug. Its copied into runtimes, databases, document readers, image libraries, language bindings, and native packages. (CVE-2026-111497)