RetroFed Forum
Your home away from modern life.
Search Categories Forum list Register Log in
About RetroFed
RetroFed

Welcome to the nostalgia-filled piefed instance of yesteryear.

Open Registration with Application questionnaire.

If you have a question or comment you can post in !meta@retrofed.com or message @DosDude@retrofed.com or @Die4Ever@retrofed.com

In case of downtime and/or emergency, we will post updates on @DosDude@mastodon.social

Some rules we try to uphold:

  • Be civil. Bigotry is not welcome. This includes (but is not limited to): transphobia, queerphobia, racism, ageism and ableism. We do not promote hate.
  • Communities need to be Retro or Retro-adjacent.
  • Please don't upload pornographic content. (use an external image host for that)
72 registered users
Administrators: DosDude, Die4Ever
Visit retrofed.com
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497) - Affecting Node.js, Python, C library
Post Reply RetroFed Forum Forum Index » Technology
AuthorMessage
Sir. Haxalot nord.pub SirHaxalot@nord.pub
Joined: 2026-02-03
Quote

Link: https://broccoli2shell.com/

CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google's Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
43   Original
UltraBlack lemmy.world UltraBlack@lemmy.world
Joined: 2023-06-20
#2 · Quote Reply

Craziest 7 days
19
dan upvote.au dan@upvote.au
Joined: 2023-06-14
#3 · (edited) Quote Reply

For Nginx on Debian, I need to figure out if just updating the libbrotli1 package is sufficient, or if libnginx-mod-http-brotli needs to be updated too. I suspect it's dynamically linked (since that's standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.
4
pipe01 programming.dev pipe01@programming.dev
Joined: 2023-12-20
#4 · Quote Reply

Installing the update isn't enough. A running process keeps the old decoder until it restarts

Yes, that's kinda how computers work?
17
lnxtx (xe/xem/xyr) sopuli.xyz lnxtx@sopuli.xyz
Joined: 2025-09-02
#5 · Quote Reply
pipe01 wrote:
Installing the update isn't enough. A running process keeps the old decoder until it restarts Yes, that's kinda how computers work?

Sure, but good reminder anyway.
6
lnxtx (xe/xem/xyr) sopuli.xyz lnxtx@sopuli.xyz
Joined: 2025-09-02
#6 · Quote Reply
UltraBlack wrote:
Craziest 7 days

yet.
9
Sir. Haxalot nord.pub SirHaxalot@nord.pub
Joined: 2026-02-03
#7 · Quote Reply
pipe01 wrote:
Installing the update isn't enough. A running process keeps the old decoder until it restarts Yes, that's kinda how computers work?

Imo still worth reminding people that just because you run an apt/dnf upgrade
running applications still map the now unlinked outdated version.
10
Post Reply
Back to top
Powered by PieFed · PieBB frontend · All times are Europe/Amsterdam