Brotli decoder bug allows remote code execution (CVE-2026-111497)
Original title: Brotli bug reaches far beyond Node.js (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
CVE-2026-111497 is a remotely exploitable out-of-bounds write in Google’s Brotli decoder, also called Node2Shell, Broccoli2Shell and Brotli2Shell. Node.js said on October 21, 2026, that attacker-supplied Brotli data decompressed with node:zlib can crash a process, disclose memory or run code. Fixed Brotli releases 1.2.1, 1.1.1 and 1.0.10 arrived last week, and Node.js patched 26.12.1, 24.22.1 and 22.23.4. Proof-of-concept exploits are on GitHub, and ELLIO reports exploit traffic in the wild.
Unconfirmed: In-the-wild exploitation is ELLIO’s sensor report, not independently confirmed in the article.
- The decoder fix was committed on 27 February 2026 with no release or advisory for eight months.
- End-of-life Node.js 20.x, 23.x and 25.x are affected and will not be fixed.
- Tenable lists .NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse as potentially at risk.
- Imperva demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image.
- ELLIO links attempts to 94.154.43.7, previously tied to PHP2Shell and VPN probing.
Impact: crash, memory disclosure, or remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | — | 1.2.1, 1.1.1, and 1.0.10 |
| Node.js | 26.x, 24.x, and 22.x; end-of-life 20.x, 23.x and 25.x | 26.12.1, 24.22.1, and 22.23.4 |
- 1.Upgrade Node.js to 26.12.1, 24.22.1, or 22.23.4.
- 2.Move Brotli to 1.2.1, 1.1.1, or 1.0.10, then rebuild images and restart services.
- 3.Check downstream vendor advisories before treating a bundled decoder as exposed.
- CVEs
- CVE-2026-111497
- Organizations
- TenableAikido SecurityRapid7ImpervaELLIO
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 94.154.43.7 | d gets a shell on vulnerable builds.” The company says that 94.154.43.7 – the IP address from which exploitation attempts are comin |
From the original article
2 min read at helpnetsecurity.com
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node. js publicly disclosed it on October 21, 2026.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.