Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk.
About CVE-2026-111497
Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026.
“An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution,” Node.js maintainers explained, and pointed to the source of the flaw: the Brotli decoder.
Fixes available and incoming
The fix for CVE-2026-111497 was committed to google/brotli on 27 February 2026, with no release and no advisory, and stayed publicly readable for eight months. Brotli versions 1.2.1, 1.1.1, and 1.0.10, which carry the fix, were made available only last week.
Since Brotli is bundled with Node.js, the flaw affects Node.js 26.x, 24.x, and 22.x release branches. Node.js maintainers have fixed it in versions 26.12.1, 24.22.1, and 22.23.4. (End-of-life 20.x, 23.x and 25.x lines are also affected, but will not get a fix.)
But, as Tenable researchers noted, “any application that decompresses attacker-controlled data with a vulnerable Brotli decoder is potentially at risk, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse.”
Maintainers of most of these projects have already updated dependencies and made available fixed releases. Various Linux distributions have released or are in the process of releasing packages with a fix.
Aikido Security listed affected runtimes and Brotli libraries, and advised: “Update dependency locks, rebuild affected applications and container images, redeploy, and restart services. Verify that running workloads use the patched components.”
Additional information about available fixes is available on the Broccoli2Shell dedicated site.
Rapid7 noted that affected versions, default exposure, and remediation vary by product, and that the presence of an affected decoder does not mean exposure, unless an application processes attacker-controlled Brotli data.
“Organizations should consult the relevant downstream vendor or distribution advisories to identify affected versions, assess exposure, and determine appropriate remediation,” the company advised.
PoC and in-the-wild exploits
Proof-of-concept exploits for CVE-2026-111497 have been published on GitHub. Imperva has demonstrated that the flaw can be exploited to achieve remote code execution against the official Node.js 24.22.0 Linux arm64 image, after multiple attempts.
Threat intelligence firm ELLIO reported on Monday that its sensors “have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds.”
The company says that 94.154.43.7 – the IP address from which exploitation attempts are coming – has previously been observed carrying exploits for PHP2Shell and has been involved in Palo Alto GlobalProtect and FortiOS SSL VPN probing, and Kubernetes API and container orchestration scanning.
“This is indicative of the RCE being adopted by an operator focused on mass exploitation,” they opined.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
