Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Original title: Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
A buffer overflow in the Brotli C decoder, tracked as CVE-2026-111497 and nicknamed HTTP2Shell, Node2Shell, and Broccoli2Shell, can corrupt memory when an application decompresses attacker-controlled data. It affects Brotli 1.0.3 through 1.0.9, 1.1.0, and 1.2.0, including copies used by Node.js, some Python HTTP clients, and .NET. Node.js says the bug can crash a process, expose memory, or enable remote code execution. Microsoft shipped an emergency .NET update warning of privilege escalation. Proof-of-concept exploits are public, but no malicious exploitation is reported.
- Affected Brotli releases are 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.
- Patched builds are Brotli 1.0.10, 1.1.1, and 1.2.1, and Node.js 22.23.4, 24.22.1, and 26.12.1.
- Node.js and Google shipped stable fixes on October 21 and disclosed the flaw the next day.
- Microsoft warned that exploitation can escalate privileges on vulnerable .NET systems.
- Updating the system Brotli library does not fix applications that bundle their own copy.
Impact: Memory corruption, data exposure, or remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | — | 22.23.4, 24.22.1, 26.12.1 |
| Python Brotli | — | 1.2.1 |
| Python brotlicffi | — | 1.2.1.0 |
| Microsoft .NET | — | — |
- 1.Install the listed Brotli, Node.js, Python, and .NET security updates.
- 2.Restart affected processes and rebuild and redeploy affected container images.
- 3.If patching is delayed, remove Brotli support or block incoming Brotli-compressed requests.
- CVEs
- CVE-2026-111497
- Organizations
- Imperva
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at bleepingcomputer.com
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node. js, could allow attackers to corrupt memory and access sensitive data. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.