Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
Original title: CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
Zscaler ThreatLabz describes CVE-2026-111497 in Brotli’s block-decoding logic. A fast-path macro does not check the return value of DecodeBlockTypeAndLength, so a malicious stream can leave the decoder in an invalid state and cause an out-of-bounds write usable as an RCE primitive. Inbound attacks would use crafted compressed HTTP request bodies; outbound attacks would use crafted responses from an attacker-controlled or compromised server. The upstream fix returns and propagates a distinct error so decoding stops.
Unconfirmed: The post describes possible inbound and outbound paths and does not say the flaw is being exploited.
- Brotli content is marked by the Content-Encoding: br header.
- The bug is in fast-path handling of block-type and length changes.
- Outbound paths include fetch(), webhooks, URL previews, crawlers, and API clients.
- The fix stops decoding after a malformed block-switch condition.
Impact: Out-of-bounds write usable as a remote code execution primitive
| Product | Affected |
|---|---|
| Google Brotli | — |
- CVEs
- CVE-2026-111497
- Vendors
- Products
- Brotli
- Organizations
- Zscaler ThreatLabz
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
1 min read at zscaler.com
IntroductionOn October 21, 2026, the Node. js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node. js and other software.
By Atinderpal Singh (Senior Manager, Threat Research) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.