Google Brotli decoder CVE-2026-111497 can yield remote code execution
Original title: Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
Tenable's FAQ covers CVE-2026-111497, an out-of-bounds write in Google's Brotli C decoder. Crafted data can crash a process, leak memory, or lead to remote code execution, and public proofs of concept exist. Node.js disclosed the flaw on October 21, when Google released fixed Brotli versions; NVD published the record on October 22. Software that bundles its own decoder needs a separate update, and end-of-support Node.js lines 20, 23, and 25 receive none.
Unconfirmed: In-the-wild exploitation is not stated, and some projects had not shipped fixes as of October 26.
- Microsoft rates the .NET issue 8.1 and says .NET Framework is not affected.
- .NET is exposed only when Brotli decompression is actually used.
- JFrog controlled FFmpeg's instruction pointer via JPEG XL but did not show code execution.
- A 534-byte input looped Apache Arrow, and one request crashed a tested ClickHouse server.
- Akamai said 61% of networks were running affected Node.js versions.
Impact: Process crash, memory leak, or potential remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 to 1.0.9, 1.1.0, 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | < 22.23.4, < 24.22.1, < 26.12.1 | 22.23.4, 24.22.1, 26.12.1 |
| Bun | >= 1.0.21, < 1.4.4 | 1.4.4 |
| Envoy Proxy | <= 1.36.11, <= 1.37.7, <= 1.38.5, <= 1.39.2 | 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0 |
| Istio | < 1.29.9, < 1.30.6, < 1.31.2 | 1.29.9, 1.30.6, 1.31.2 |
| Microsoft .NET | 8 < 8.0.33; 9 < 9.0.22; 10 < 10.0.14; 11 < Release Candidate 3 | 8.0.33, 9.0.22, 10.0.14, Release Candidate 3 |
| PHP for Windows | Windows builds bundling Brotli 1.0.3 to 1.2.0 | 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 |
- 1.Install the fixed release of each application that bundles Brotli, not only the system library.
- 2.Rebuild and redeploy NativeAOT and self-contained .NET applications after updating.
- 3.Replace end-of-support Node.js 20, 23, and 25, which receive no fixed release.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
7 min read at tenable.com
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node. js, .
By Satnam Narang · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.