Broccoli2Shell: The One Decoder We All Depend On
Comments on “Broccoli2Shell: The One Decoder We All Depend On”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
CVE-2026-111497 is a heap out-of-bounds write in Google's Brotli C decoder, present from 1.0.3 through 1.2.0 and fixed in 1.2.1, where an invalid block switch now returns an error. Semgrep's list shows the decoder is bundled in Node.js, Bun, .NET, Envoy, Python wheels, and database and document tools, so updating one package leaves other copies. Several, including DuckDB, Apache Arrow and Pillow, have no release yet. Builders need to inventory vendored copies, since some claims in the post, such as DuckDB's status, could not be independently verified.
Why it ranked
No. 4 of 155 with a score of 0.75. The panel rated it highest on practical relevance (0.93) and audience breadth (0.88), lowest on substantiated (0.65).
- AI judgeJudge 2claude-haiku-5-5
- Widely deployed Brotli decoder vulnerability with an actionable affected-package inventory. Substantiated by version ranges and upstream fix, though the exploitability detail is thin and the text is partly list-driven marketing-adjacent framing.
- AI judgeJudge 3gpt-5.6-luna
- A broadly reusable native decoder vulnerability is mapped across many runtimes, libraries, and bundled artifacts, with versions, fixes, and remediation guidance. It is highly actionable and well supported, though the universal headline and some scope claims exceed the demonstrated evidence.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.75total under rubric v2.2
- Significance0.75
- Reader interest0.86
- Audience breadth0.88
- Practical relevance0.93
- Substantiated0.65
- Technical depth0.67
- New information0.82
- Counts against: Promotional0.14
- Counts against: Overclaim0.48
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.75 | 0.72 | 0.78 | 0.75 | 0.06 | +0.24 | +0.180 |
| Reader interest | 0.79 | 0.85 | 0.93 | 0.86 | 0.14 | +0.26 | +0.223 |
| Audience breadth | 0.97 | 0.80 | 0.87 | 0.88 | 0.17 | +0.13 | +0.115 |
| Practical relevance | 0.98 | 0.90 | 0.90 | 0.93 | 0.08 | +0.22 | +0.204 |
| Substantiated | 0.59 | 0.55 | 0.82 | 0.65 | 0.27 | +0.05 | +0.033 |
| Technical depth | 0.84 | 0.45 | 0.70 | 0.67 | 0.40 | +0.05 | +0.033 |
| New information | 0.91 | 0.60 | 0.96 | 0.82 | 0.36 | +0.05 | +0.041 |
| Promotional | 0.05 | 0.20 | 0.18 | 0.14 | 0.15 | −0.19 | −0.027 |
| Overclaim | 0.48 | 0.30 | 0.65 | 0.48 | 0.35 | −0.11 | −0.052 |
| Sum of contributions | +0.748 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.748 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/4/"><img src="https://rubric.hrih.si/badge/2026-10-28/4.svg" alt="Ranked #4 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 matches source · 3 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
CVE-2026-111497 is a heap out-of-bounds write in Google's Brotli C decoder.
The article gives no link or citation for it.
The article says “CVE-2026-111497 is a Heap out-of-bounds write in Google's Brotli C decoder”
The source says No source to compare with.
Matches sourceVersion
The upstream fix for CVE-2026-111497 is in Brotli 1.2.1 (commit 0ed4268a), and it makes invalid block-switch state return a decoder error instead of being treated as needing more input.
The cited source says the same thing.
The article says “The important change is that invalid block-switch state now returns a real decoder error instead of being treated as “need more input”
The source says “return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH”
Source cited by the article: github.com/google/brotli/commit/0ed4268a
Matches sourceVersion
The vulnerable Brotli versions range from 1.0.3 through 1.2.0, with the fix in 1.2.1.
The cited source says the same thing.
The article says “1.0.3–1.2.0, excluding patched backports”
The source says “v1.0.10 (v1.0.10, 2026-10-21) ### SECURITY - CVE-2026-111497: out-of-bounds write permits remote code execution”
Source cited by the article: github.com/google/brotli
No source givenGeneralization
The Brotli decoder has been copied into runtimes, browsers, databases, proxies, document tools, image libraries, and language bindings, so updating one package does not update every copy.
The article gives no link or citation for it.
The article says “That decoder has been copied into runtimes, browsers, databases, proxies, document tools, image libraries, and language bindings”
The source says No source to compare with.
Matches sourceVersion
Node.js releases 22.23.4, 24.22.1 and 26.12.1 fix the bundled Brotli in deps/brotli.
The cited source says the same thing.
The article says “22.23.4, 24.22.1, 26.12.1”
The source says “CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov”
Source cited by the article: github.com/nodejs/node
Couldn’t checkVersion
DuckDB's vendored Brotli copy has no fix yet.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “unpatched bundled copy”
The source says No passage could be compared.
Source cited by the article: github.com/duckdb/duckdb
No source givenCausal conclusion
The bug went unnoticed since Brotli 1.0.3 because fixing it would have required a skilled researcher familiar with C code and the Brotli decoder before AI.
The article gives no link or citation for it.
The article says “prior to AI, it would need a skilled researcher familiar with C code and the Brotli compression decoder, which is probably why no one picked it up in Brotli 1.0.3”
The source says No source to compare with.
Couldn’t checkGeneralization
Node2Shell covered the Node.js attack paths for this vulnerability.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Node2Shell covered the Node.js attack paths”
The source says No passage could be compared.
Source cited by the article: semgrep.dev/blog/2026/patch-your-node-and-eat-your-brotli-or-you-wont-get-dessert
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.