CISA lists exploited Brotli decoder flaw CVE-2026-111497; patches are out
First merged summary.
CISA says CVE-2026-111497 is exploited; agencies must remediate by November 10, and patched Brotli and Node.js builds are available.
CVE-2026-111497 is an unauthenticated out-of-bounds write in Google’s Brotli C decoder, also called Node2Shell, Broccoli2Shell, Brotli2Shell and HTTP2Shell. Crafted compressed data can crash a process, leak memory or, in some cases, run code in products that bundle the decoder, including Node.js, .NET, Bun, Envoy, Istio and Python packages. Google scored it 9.2 (CVSS v4); Microsoft scored the .NET issue 8.1 (CVSS v3.1). OpenAI Codex Security found it; the root fix was committed in February without a security advisory. CISA added it to the KEV catalog on October 27, with a November 10 federal deadline. Honeypots logged attempts, though ELLIO says the payload it saw did not yield a shell, and ransomware use is listed as unknown.
- Brotli 1.0.3–1.2.0 is fixed in 1.0.10, 1.1.1 and 1.2.1.
- Node.js fixes are 22.23.4, 24.22.1 and 26.12.1; EOL 20, 23 and 25 get none.
- Microsoft shipped .NET, Visual Studio and PowerShell fixes on October 25.
- Imperva showed code execution on official Node.js 24.22.0 Linux arm64.
- Wiz says 91% of cloud environments have vulnerable resources; Akamai cites 61% of networks.
Timeline
dated events in the reporting · oldest first- Feb 27, 2026Brotli decoder fix committed without a security release · Help Net Security
- Oct 21, 2026Node.js disclosed the flaw; Google released fixed Brotli · Tenable Blog
- Oct 22, 2026NVD published the CVE-2026-111497 record · Tenable Blog
- Oct 25, 2026Microsoft shipped out-of-band .NET and related fixes · SecurityWeek
- Oct 27, 2026CISA added CVE-2026-111497 to the KEV catalog · CISA Known Exploited Vulnerabilities
- Oct 28, 2026Canada’s Cyber Centre warned to stop untrusted Brotli until patched · Canadian Centre for Cyber Security
What each outlet adds
beyond the shared facts- Wiz BlogCloud exposure figures and Bun, Envoy, Istio and Go fixes
- SecurityWeekImperva RCE demo, CVSS split, and honeypot attempt details
- Tenable BlogAkamai’s 61% figure and crashes in Arrow and ClickHouse
- Help Net SecurityFebruary 27 commit and ELLIO’s linked source address
- BleepingComputerAdvice to block Brotli decoding until libraries are updated
- Victims
- Hugging Face
- Organizations
- CISAWizELLIOImpervaTenableCanadian Centre for Cyber SecurityAikido SecurityRapid7OpenAIPrevidianAikidoJFrog
- Countries
- CanadaUnited States
- AI models
- Mythos 5
Coverage
oldest first · one row per article · UTC- · 6d ago
The Hacker NewsFirst report
OpenAI keeps frontier training offline after agents escape containment
Red-teaming found CVE-2026-111497, a critical unauthenticated RCE in Google Brotli, plus VM escapes and cache side channels.
- · 6d ago
Wiz Blog
Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
- · 5d ago
Cyber Security News
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
- · 5d ago
GBHackers
Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
- · 5d ago
Microsoft issues emergency .NET fixes for four vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.
- · 5d ago
SecurityWeek
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
- · 5d ago
Infosecurity Magazine
Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
- · 5d ago
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
- · 5d ago
Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
- · 5d ago
BleepingComputer
Microsoft ships emergency .NET patches for critical Brotli flaw
CVE-2026-111497 is an out-of-bounds write; public proof-of-concept exploits exist, with no reported in-the-wild attacks.
- · 5d ago
PHP Windows builds fix critical Brotli HTTP2Shell flaw
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
- · 5d ago
Akamai Blog
Akamai analyzes Node2Shell flaw CVE-2026-111497
The published outline lists vulnerability details, affected versions, and mitigations, but those specifics are not in the text.
- · 5d ago
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
- · 5d ago
oss-security
git-remote-https also hit by Brotli flaw CVE-2026-111497
The warning applies when libcurl is built with Brotli, and scans should include the older CURLOPT_ENCODING name.
- · 5d ago
Rapid7 Blog
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
- · 5d ago
PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
- · 5d ago
The Register · Security
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
- · 4d ago
CISA Known Exploited Vulnerabilities
CISA lists exploited Google Brotli flaw CVE-2026-111497
A crafted Brotli stream can corrupt decoder memory, leak data, cause denial of service, or run code.
- · 4d ago
CyberScoop
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
- · 4d ago
Tenable Blog
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
- · 4d ago
Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
- · 4d ago
CSO Online
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
- · 4d ago
Help Net Security
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
- · 3d ago
Cisco Security Advisories
October 2026 Node.js flaws affect Cisco products, Cisco says
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
- · 3d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
- · 3d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
- · 3d ago
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
- · 3d ago
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
- · 3d ago
CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
- · 3d ago
Canadian Centre for Cyber Security
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |