Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
88
- Mentions · 7d8
- Mentions · 30d10
- All mentions11
- First seenSep 8, 2026
- Last mentioned2d ago
Timeline
11 articles · newest firstCISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
84
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
58
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
58
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
74
Brotli bug CVE-2026-111497 draws patches beyond Node.js
Trail of Bits released an audit tool; Node.js credited OpenAI researchers, and real-world exploitation is not stated.
73
Brotli decoder flaw CVE-2026-111497 can leak memory or run code
Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.
76
Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
74
Node.js security-release thread cites Envoy and OpenSSL advisories
The truncated reply links two GitHub advisories and only suggests OpenSSL processing may be involved.
34
QPACK flaws let one HTTP/3 connection exhaust server memory
Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.
68
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
62
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2026-86207<1%7.7Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3
- CVE-2026-12523<1%7.5Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames
- CVE-2026-86206<1%6.9Access Control Filter Bypass in N-able N-central Exposes Internal APIs
- CVE-2025-13945<1%5.5HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
- CVE-2025-64702<1%5.3quic-go is an implementation of the QUIC protocol in Go
Appears with
- Node.jsproduct · 9
- Bunproduct · 9
- Istioproduct · 8
- Brotliproduct · 5
- Googlevendor · 5
- OpenAIorganization · 4
- Impervaorganization · 3
- CISAorganization · 3
- brotlicffiproduct · 3
- .NETproduct · 2
- Pythonproduct · 2
- brotli4jproduct · 2
- Sweet Safety Netproduct · 2
- Sweet Securityvendor · 2
- Irisproduct · 2
- Traefikproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.