CISA lists exploited Brotli decoder flaw CVE-2026-111497
First merged summary.
CVE-2026-111497, an exploited Brotli out-of-bounds write, is on CISA’s KEV list; US agencies must remediate by November 10.
CISA added CVE-2026-111497, an unauthenticated out-of-bounds write in Google’s Brotli decoder, to the Known Exploited Vulnerabilities catalog on October 27, 2026, after confirmed exploitation. The bug, also called Node2Shell, Broccoli2Shell, and HTTP2Shell, is scored 9.2 and can crash processes, leak memory, or in some cases execute code when untrusted Brotli data is decoded. Node.js fixed supported lines on October 21 in 22.23.4, 24.22.1, and 26.12.1; end-of-life 20.x, 23.x, and 25.x will not be patched. Brotli fixes are 1.0.10, 1.1.1, and 1.2.1. US federal agencies must remediate by November 10 under BOD 26-04. Ransomware use is listed as unknown.
- Affected Brotli is 1.0.3 through 1.2.0; fixes are 1.0.10, 1.1.1, and 1.2.1.
- Node.js patches: 22.23.4, 24.22.1, and 26.12.1; EOL 20.x, 23.x, and 25.x have none.
- Also hits Bun before 1.4.4, Python Brotli and brotlicffi, .NET, Envoy, Istio, and brotli4j.
- Patched Node.js can still report process.versions.brotli as 1.2.0.
- Until patched, stop decoding untrusted Brotli, including at a proxy or firewall.
- Patchstack says public WordPress tooling causes denial of service, not PHP code execution.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js and upstream Brotli publish fixes for CVE-2026-111497. · Cisco Security Advisories
- Oct 22, 2026A public proof of concept for the Brotli bug appears. · Datadog Security Labs
- Oct 27, 2026CISA adds CVE-2026-111497 to the KEV catalog. · Cyber Security News
- Oct 28, 2026Canada’s Cyber Centre warns of the Brotli out-of-bounds write. · Canadian Centre for Cyber Security
- Oct 30, 2026Patchstack says stock WordPress can crash via libcurl Brotli replies. · Patchstack
What each outlet adds
beyond the shared facts- Zscaler ThreatLabzMissed DecodeBlockTypeAndLength check enables the out-of-bounds write.
- Datadog Security LabsPublic PoC on October 22; patched Node still reports Brotli 1.2.0.
- GBHackersELLIO reproduced shells; failed crashes can dump secrets.
- PatchstackWordPress pingbacks can crash PHP via libcurl unpacking Brotli.
- Canadian Centre for Cyber SecurityLists Node.js, .NET, PowerShell, Bun, Envoy, Istio, and Python packages.
- Countries
- CanadaUnited States
Coverage
oldest first · one row per article · UTC- · 2d ago
BleepingComputerFirst report
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
- · 2d ago
Cyber Security News
CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
- · 2d ago
Canadian Centre for Cyber Security
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
- · 2d ago
Zscaler ThreatLabz
Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
- · 2d ago
Cisco Security Advisories
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
- · 2d ago
Datadog Security Labs
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
- · 1d ago
GBHackers
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
- · 1d ago
Ubuntu Security Notices
Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
- · 14h ago
Patchstack
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |