Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
Original title: Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
On October 21, 2026, Node.js patched CVE-2026-111497, an out-of-bounds write in its bundled Google Brotli decoder, scored CVSS 9.2. The same library flaw affects Python, Bun, .NET, Java brotli4j, Envoy, and Istio; fixes exist, but end-of-life Node.js lines have none. Datadog reproduced the bug on Node.js 24.22.0 and confirmed the patched build rejects the same bytes. A public proof of concept appeared on October 22. As of October 29, exploitation is confirmed and CISA's known exploited vulnerabilities catalog lists the CVE.
- Fixed Node.js releases are 22.23.4, 24.22.1, and 26.12.1.
- Patched Node.js 24.22.1 still reports process.versions.brotli as 1.2.0.
- Express 5 and body-parser 2.x accept Brotli request bodies by default.
- Node.js fetch decodes Content-Encoding: br even when identity is forced.
- brotli4j jars and bun build --compile binaries stay vulnerable until updated or rebuilt.
Impact: Out-of-bounds write; code execution shown and public PoC crashes
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22, 24, and 26 before 22.23.4, 24.22.1, and 26.12.1; unpatched end-of-life lines | 22.23.4, 24.22.1, 26.12.1 |
| Google Brotli | 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Python Brotli and brotlicffi | 1.2.0 and earlier | 1.2.1 and 1.2.1.0 |
| Bun | 1.0.21 through 1.4.3 | 1.4.4 |
| brotli4j | 1.23.0 and earlier | 1.24.0 |
| .NET | 8, 9, and 10 before the October 25, 2026 out-of-band update | 8.0.33, 9.0.22, 10.0.14 |
| Envoy | All releases before the first fix in each supported branch | 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0 |
| Istio | All releases before the first fix in each supported branch | 1.29.9, 1.30.6, 1.31.2 |
- 1.Upgrade affected Node.js, Brotli, Python, Bun, brotli4j, .NET, Envoy, and Istio builds to the stated fixed releases.
- 2.If patching must wait, set inflate to false or reject Content-Encoding: br at the proxy.
- 3.Do not treat an operating-system libbrotli update as a fix for Java brotli4j.
- CVEs
- CVE-2026-111497
- Vendors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
9 min read at securitylabs.datadoghq.com
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node. js and other runtimes, and explain how to detect and remediate it.
By @datadoghq · securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.