Critical Brotli Decoder Vulnerability Enables Remote Code Execution in Node.js and Python

A newly disclosed vulnerability in the Brotli decoder allows attackers to remotely execute code in Node.js, Python, and other runtimes.

A serious remote code execution (RCE) vulnerability, tracked as CVE-2026-111497 and dubbed 'Broccoli2Shell,' has been disclosed in the Brotli compression decoder used across multiple popular programming ecosystems including Node.js and Python. Brotli is a widely adopted compression algorithm developed by Google, built into browsers and bundled with many server-side runtimes and package ecosystems, meaning the attack surface for this flaw is broad. The vulnerability was discovered and reported by security firm Aikido, which published technical details on its blog. Exploiting the flaw could allow a remote attacker to execute arbitrary code on a vulnerable system simply by delivering a maliciously crafted Brotli-compressed payload — requiring no authentication.

Why it matters

Brotli decoders are embedded in a vast number of web servers, APIs, and applications built on Node.js and Python, meaning millions of production systems could be exposed to unauthenticated remote code execution. Developers using affected packages should apply patches or mitigations immediately.

What's next

Developers and system administrators should check Aikido's published advisory for the specific affected package versions and apply patches as they become available.

Key facts

Bias & framing notes

Source 1 links to a technical blog post by Aikido, the firm that discovered the vulnerability — meaning the primary reporter is also the discoverer, which is common in security research but introduces a potential conflict of interest around severity framing. Source 2 had no body text available, so no independent corroboration of technical details could be assessed. No mainstream or trade press coverage was available to cross-check claims.

NewsClear — neutral news & congressional tracking · Bill of the Week