BROCCOLI2SHELL: EVERYTHING YOU NEED TO KNOW ABOUT THE CRITICAL BROTLI DECODER VULNERABILITY

Summary from the TLDR DevOps newsletter

CVE-2026-111497, also known as Broccoli2Shell, is a critical vulnerability in the Brotli decompression library that allows remote code execution. The flaw affects Node.js, Bun, and Envoy Proxy. Wiz data shows 91% of cloud environments have vulnerable resources. Organizations should apply security updates and rebuild affected workloads.