CVE-2026-111497, nicknamed Broccoli2Shell, is a critical remote code execution flaw in the Brotli decompression library. It affects Node.js, Bun, Envoy Proxy, and Istio — and Wiz data shows 91% of cloud environments have vulnerable resources.
Broccoli2Shell: The Node.js Vulnerability Sitting in 91% of Cloud Environments










