Open-Source

vulnerabilities 2026-10-26 Critical
Broccoli2Shell: CVE-2026-111497 Brotli Decoder Out-of-Bounds Write Gives RCE in Node.js
A CVSS 9.2 out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) lets crafted compressed data corrupt memory in Node.js and other consumers; public PoCs exist and Node.js shipped fixes October 21.
rce memory-corruption nodejs web-server open-source proof-of-concept

Broccoli2Shell: CVE-2026-111497 Brotli Decoder Out-of-Bounds Write Gives RCE in Node.js