Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
Stories per day · 30 days
2 RSS
Relatedbrotli8nodejs8istio5dotnet2http2shell2kev2out-of-bounds-write2python2rce2sweet-security2virtual-patching2advisories1bun1memory-corruption1node-js1openssl1
9 stories, newest first · one card per story
Stories tagged #envoy
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
1
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
Brotli bug CVE-2026-111497 draws patches beyond Node.js
Trail of Bits released an audit tool; Node.js credited OpenAI researchers, and real-world exploitation is not stated.
Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
Node.js security-release thread cites Envoy and OpenSSL advisories
The truncated reply links two GitHub advisories and only suggests OpenSSL processing may be involved.
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
5