Comment by j12y

Brotli is bigger than node2shell, php2shell or an npm bug. Its copied into runtimes, databases, document readers, image libraries, language bindings, and native packages. (CVE-2026-111497)