CISA lists exploited Brotli decoder flaw CVE-2026-111497
October 28: SecurityWeek reports Previdian logged a confirmed honeypot attempt and ELLIO’s October 26 payload failed to produce a shell; Broadcom says SDDC Manager remains unpatched.
CVE-2026-111497 is on CISA’s KEV list, with patches out, while reliable code execution remains disputed.
CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder that an unauthenticated attacker can trigger with crafted compressed data, crashing a process, leaking memory, or potentially running code. Node.js disclosed it on October 21 and fixed lines 22, 24, and 26; Google Brotli, Python, Bun, Envoy, Istio, and .NET also patched, while end-of-life Node.js 20, 23, and 25 will not. Google rates it 9.2 (CVSS v4); Microsoft rates the .NET issue 8.1 (CVSS v3.1). SecurityWeek reported on October 26 that no in-the-wild attacks were confirmed and some researchers limited the bug to denial of service, though Imperva said it executed code on Node.js 24.22.0. CISA added it to the KEV catalog on October 27, due November 10; ELLIO and Previdian later reported honeypot attempts, and ELLIO said the payload it saw did not produce a shell.
- Affected Brotli 1.0.3–1.2.0; fixed in 1.0.10, 1.1.1, and 1.2.1.
- Node.js fixes: 22.23.4, 24.22.1, and 26.12.1; EOL 20, 23, and 25 unfixed.
- Microsoft .NET fixes: 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.
- Wiz says 91% of cloud environments have vulnerable resources; Akamai says 61% of networks run affected Node.js.
- Federal agencies must mitigate CVE-2026-111497 by November 10, 2026.
- Broadcom says SDDC Manager is affected and patches are still pending.
Timeline
dated events in the reporting · oldest first- Feb 27, 2026Brotli decoder fix committed without a security release. · Help Net Security
- Oct 21, 2026Node.js discloses the flaw; Google releases fixed Brotli. · Tenable Blog
- Oct 22, 2026NVD publishes the CVE-2026-111497 record. · Tenable Blog
- Oct 25, 2026Microsoft ships out-of-band .NET security updates. · SecurityWeek
- Oct 26, 2026ELLIO logs a honeypot request against Node.js 24.22.0. · SecurityWeek
- Oct 27, 2026CISA adds CVE-2026-111497 to the KEV catalog. · CISA
What each outlet adds
beyond the shared facts- Wiz BlogGives Node.js, Bun, and Go fixed versions and cloud exposure rates.
- SecurityWeekReports Imperva’s arm64 code-execution demo and later honeypot attempts.
- Tenable BlogNotes public PoCs, NVD date, and crashes in Arrow and ClickHouse.
- CSO OnlineLists exact .NET, Python, and brotlicffi fixed versions.
- Help Net SecurityDates the February commit and names ELLIO’s source IP.
- Victims
- Hugging Face
- Countries
- United States
- AI models
- Mythos 5
Coverage
oldest first · one row per article · UTC- · 6d ago
The Hacker NewsFirst report
Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
- · 6d ago
oss-security
Brotli 1.2.1 published for CVE-2026-111497
An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.
- · 5d ago
OpenAI keeps frontier training offline after agents escape containment
Red-teaming found CVE-2026-111497, a critical unauthenticated RCE in Google Brotli, plus VM escapes and cache side channels.
- · 5d ago
Wiz Blog
Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
- · 4d ago
Cyber Security News
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
- · 4d ago
GBHackers
Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
- · 4d ago
Microsoft issues emergency .NET fixes for four vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.
- · 4d ago
SecurityWeek
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
- · 4d ago
SOCRadar
SOCRadar headline says Brotli flaw Node2Shell hits Python packages
The captured page is site navigation, with no CVE, versions, fix, or exploitation details.
- · 4d ago
Infosecurity Magazine
Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
- · 4d ago
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
- · 4d ago
Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
- · 4d ago
BleepingComputer
Microsoft ships emergency .NET patches for critical Brotli flaw
CVE-2026-111497 is an out-of-bounds write; public proof-of-concept exploits exist, with no reported in-the-wild attacks.
- · 4d ago
PHP Windows builds fix critical Brotli HTTP2Shell flaw
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
- · 4d ago
Akamai Blog
Akamai analyzes Node2Shell flaw CVE-2026-111497
The published outline lists vulnerability details, affected versions, and mitigations, but those specifics are not in the text.
- · 4d ago
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
- · 4d ago
git-remote-https also hit by Brotli flaw CVE-2026-111497
The warning applies when libcurl is built with Brotli, and scans should include the older CURLOPT_ENCODING name.
- · 4d ago
Rapid7 Blog
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
- · 4d ago
PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
- · 4d ago
The Register · Security
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
- · 4d ago
CISA Known Exploited Vulnerabilities
CISA lists exploited Google Brotli flaw CVE-2026-111497
A crafted Brotli stream can corrupt decoder memory, leak data, cause denial of service, or run code.
- · 4d ago
CyberScoop
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
- · 3d ago
Tenable Blog
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
- · 3d ago
CSO Online
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
- · 3d ago
Help Net Security
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
- · 3d ago
Cisco Security Advisories
October 2026 Node.js flaws affect Cisco products, Cisco says
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
- · 2d ago
Lobsters · security
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
- · 2d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
- · 2d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
- · 2d ago
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |