Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
Original title: Experts temper emergency-level alarms over critical Brotli defect
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
A buffer overflow in Google's Brotli decompression library, CVE-2026-111497, can crash systems and allow remote code execution. OpenAI Codex Security discovered it, and Node.js disclosed it on October 21. Researchers have not observed active exploitation. Microsoft, Python and other packages that rely on vulnerable Brotli versions issued emergency patches. Wiz says 91% of cloud environments have vulnerable resources and 82% have publicly exposed Node.js instances.
Unconfirmed: No in-the-wild exploitation is reported; Wiz's cloud exposure percentages are the firm's own measurements.
- The defect is nicknamed Node2Shell and Broccoli2Shell.
- watchTowr says impact depends on how each application uses Brotli.
- Related PHP2Shell flaws also had no known exploitation as of Monday afternoon.
- VulnCheck says AI-generated findings are increasing noise for defenders.
Impact: System crashes and remote code execution via a buffer overflow
| Product | Affected |
|---|---|
| Google Brotli | — |
- 1.Install emergency patches from vendors that bundle vulnerable Brotli.
- 2.Judge exposure by how local software uses the decompression library.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
4 min read at cyberscoop.com
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild. The post Experts temper emergency-level alarms over critical Brotli defect appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.