Brotli decoder flaw CVE-2026-111497 can leak memory or run code
Original title: This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli
Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.
Aikido says CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, versions 1.0.3 through 1.2.0, scored CVSS 9.2. A remote unauthenticated attacker can send a crafted compressed stream to corrupt memory, leak data, crash the process or potentially run code. Node.js disclosed it on October 21 as “node2shell”; Python packages and other HTTP consumers are also affected. OpenAI says it found the bug in February and the source was fixed then, but it was not treated as a security issue and no release shipped until now. Patches are listed for libbrotli, Python, Node.js, Bun, Envoy and Istio.
Unconfirmed: OpenAI’s claim that it reported the issue as unauthenticated remote code execution in February is attributed to OpenAI.
- Upgrade native Brotli to 1.2.1, or patched 1.0.10 or 1.1.1.
- Python: Brotli 1.2.1 or later and brotlicffi 1.2.1.0 or later.
- Bun 1.4.4; Envoy 1.40.0, 1.39.3, 1.38.6 or 1.37.8; Istio 1.29.9, 1.30.6 or 1.31.2.
- Advisory databases did not yet map the CVE to the PyPI packages as of October 23.
- Apache and Nginx do not decode Brotli by default.
Impact: Memory corruption, data leak, crash or possible code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | — | 22.23.4, 24.22.1, 26.12.1 |
| brotlicffi | 1.2.0.x | 1.2.1.0 |
- 1.Upgrade Brotli, Node.js, Python packages, Bun, Envoy or Istio to the listed fixed versions.
- 2.If no patch exists, disable Brotli decoding until one is available.
- 3.Rebuild images that bundle Brotli and restart services on patched components.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
11 min read at aikido.dev
⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node. js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
By aikido.dev via hoistbypetard · aikido.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.