CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google’s Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.
No, it’s only the most common way. There are also lots of systems where it’s perfectly possible, even normal, to upgrade running processes in-place without restarting.
I’m still impressed by Erlang and their hot swappable code mechanics. This isn’t really relevant to library updates, but still!