Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Original title: Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
An out-of-bounds write in Google's Brotli compression library, CVE-2026-111497 (dubbed Node2Shell), affects Brotli 1.0.3 through 1.2.0 and could allow unauthenticated remote code execution when attacker-controlled compressed data reaches the decoder. Node.js and the Python packages Brotli and brotlicffi were patched last week, and Microsoft shipped fixes for .NET, Visual Studio and PowerShell on October 25. The issue was found by OpenAI Codex Security red-teaming; the root cause had already been fixed in February without being recognized as a security bug. No exploitation in the wild has been reported, and a public PoC only works against an intentionally weakened build, with some researchers arguing the bug is limited to denial of service.
Unconfirmed: Imperva has not published its exploit and says its proof did not succeed on every attempt; some researchers argue the flaw only enables denial of service.
- Brotli 1.0.3 through 1.2.0 affected; fixed in 1.0.10, 1.1.1 and 1.2.1.
- Google scored the out-of-bounds write 9.2 (CVSS v4); Microsoft scored 8.1 (CVSS v3.1).
- Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image.
- A public tracker lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as still unpatched.
- Running services keep the vulnerable code until restarted and container images rebuilt.
Impact: memory corruption allowing crash, data leak or unauthenticated remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Microsoft .NET runtime | — | 8.0.33, 9.0.22, 10.0.14, .NET 11 RC3 |
| Microsoft Visual Studio | 2019, 2022, 2026 | — |
| Microsoft PowerShell | 7.4, 7.5, 7.6 | — |
| Python Brotli (PyPI package) | — | 1.2.1 |
| Python brotlicffi | — | 1.2.1.0 |
- 1.Update Brotli to 1.0.10, 1.1.1 or 1.2.1 and apply vendor patches.
- 2.Restart affected services and rebuild container images on a patched base.
- 3.Check whether applications pass attacker-controlled compressed data to the Brotli decoder.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at securityweek.com
An out-of-bounds write in Google’s Brotli decoder affects Node. js, . NET, PowerShell, and Python packages, and can lead to code execution.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.