Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

What is affected, what to do

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

The vulnerability is being actively exploited; treat it as a priority. Update Google Brotli to version 1.0.10, Google Brotli to version 1.1.1, Google Brotli to version 1.2.1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Google Brotli lt 1.0.3..1.0.10
• Google Brotli lt 1.1.0..1.1.1
• Google Brotli lt 1.2.0..1.2.1

Fixed in

• Google Brotli 1.0.10
• Google Brotli 1.1.1
• Google Brotli 1.2.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Start inventory: Locate every Brotli instance — system libraries (ldconfig -p | grep brotli, dpkg -l | grep -i brotli, rpm -qa | grep -i brotli), Python packages (pip show brotli; affected include brotli 1.0.9 and 1.1.0), Node.js runtimes (node -v), and statically linked copies inside container images (SBOM sweep with Syft/Trivy for brotli / libbrotlidec).
   • Patch the library: Upgrade Google Brotli to 1.0.10, 1.1.1 or 1.2.1, matching the release branch in use. For Python, upgrade the brotli package to the current release bundling the fixed decoder — patch available from the vendor, check the vendor advisory for the exact version.
   • Upgrade Node.js: Move to 22.23.4, 24.22.1 or 26.12.1, then restart all Node processes — the decoder is built into the runtime, so installing without a restart leaves you exposed.
   • Prioritise internet-facing services: Patch reverse proxies, API gateways and applications that decompress Brotli request bodies (Content-Encoding: br) or uploaded Brotli files from unauthenticated sources first.
   • Chase third-party products: Ask appliance and software vendors that statically embed Brotli for a statement; record the outcome in vulnerability management for NIS2 evidence.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/reverse proxy: Drop or return HTTP 415 for inbound requests carrying Content-Encoding: br where the application has no need for Brotli-compressed request bodies. Response compression (server → client) is unaffected by this rule.
   • Application layer: Disable decompression of untrusted input — e.g. stop Node.js body parsers (Express/Fastify) from auto-inflating br bodies; in Python services, temporarily disable or put behind authentication any upload path calling brotli.decompress().
   • Network segmentation: Restrict unpatched decoders to trusted zones; limit egress from backend servers to arbitrary internet destinations so crawlers, webhook consumers or downloaders cannot pull crafted responses from attacker-controlled hosts.
   • Endpoint hardening: Run Brotli-consuming processes with least privilege (non-root, NoNewPrivileges=yes, seccomp/AppArmor profiles via systemd or the container runtime), keep ASLR and stack protection enabled, and run containers read-only with dropped capabilities.
   • Resource limits: Enforce maximum request body sizes and memory caps (cgroups, --max-old-space-size) to contain DoS impact and make crash loops obvious.
3. 03

   Runbook step 3

   Detection rules

   • Process crashes: Linux auditd type=ANOM_ABEND or kernel log "segfault … libbrotlidec" for node/python processes; Windows Event ID 1000 (Application Error) with faulting module brotlidec/node.exe. Clusters of crashes following inbound requests strongly suggest exploitation attempts.
   • HTTP telemetry: Hunt Zeek http.log or proxy/WAF logs for externally sourced requests carrying Content-Encoding: br, e.g. SPL: index=proxy http_request_header="*Content-Encoding: br*" | stats count by src_ip, uri; correlate with 5xx spikes or reset connections.
   • Process ancestry (EDR/Sysmon EID 1): Unexpected children of web workloads, Sigma shape: ParentImage|endswith: ['\node.exe','\python.exe'] AND Image|endswith: ['\cmd.exe','\powershell.exe']; on Linux, node/python3 → sh/bash/curl/wget via auditd execve.
   • Follow-on activity: New outbound connections from application servers right after crashes or restarts (Sysmon EID 3, Zeek conn.log), especially to previously unseen destinations.
   • Suricata: Custom alert for inbound HTTP requests to hosts that never expect compressed uploads: http.header; content:"Content-Encoding|3a| br"; nocase; — alert-only until false positives are triaged.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Source: NVD (NIST), pwn.watch, fortinet_rss, Microsoft Security Update Guide, cvelistv5, CISA KEV Catalog, CSA/SingCERT, paloalto_rss, Ubuntu Security Notices, OSV (Open Source Vulnerabilities), BSI WID Portal, BSI CSAF, HKCERT (CC BY 3.0 HK) · HKCERT rating: high, Debian LTS Advisories, redhat_csaf, Debian Security Advisories

Vendors and products

• Debian
• Google
• Open Source Node.js
• Ubuntu

Weakness classes (CWE)

• CWE-252Unchecked Return Value

  Base

  The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

  Entry at MITRE CWE-252

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• nodejs.orgen/blog/vulnerability/october-2026-security-releasesPatch, web
• NVD (NIST)CVE-2026-111497 (NVD)web, pwn-watch, advisory
• imperva.comNode2Shell: From Brotli Data to Remote Code ExecutionExploit, pwn-watch
• GitHub Security Advisoriesadvisories/GHSA-9v8h-qqgm-4m35
• openwall.comlists/oss-security/2026/10/23/25
• lists.debian.orgdebian-lts-announce/2026/10/msg00049.html
• pwn.watchpwn.watch: Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releasespwn-watch
• opensourcemalware.comPython Packages Vulnerable to Node2Shellpwn-watch, web
• thehackernews.comResearchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Datapwn-watch
• nodejs.orgWednesday, October 21, 2026 Security Releasespwn-watch, web
• nodejs.orgNode.js 26.12.1 (Current)pwn-watch
• vercel.comVercel bulletin: Brotli decoder RCEpwn-watch
• aikido.devNode2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)pwn-watch
• github.comOut-of-Bounds Write in Brotli Decompressor (GHSA-3wvj-j6qm-62mr)pwn-watch
• patchtheplanet.orgBrotli vulnerability (CVE-2026-111497)pwn-watch
• aikido.devNode2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.pwn-watch
• news.ycombinator.comEvolving Threat: http2shell is an RCE in node, Python, and more (discussion)pwn-watch
• github.comgoogle/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2bweb, fix
• github.comgoogle/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0web
• github.comgoogle/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6web

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 27.10.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-10-27
   Due Date	added	—	2026-10-27
   Required Action	added	—	2026-10-27
   Vulnerability Name	added	—	2026-10-27

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

2. 27.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
   SSVC assessment	removed	{"id":"CVE-2026-111497","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-111497","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-27T19:53:21.238552Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 27.10.2026Record modifiedgoogle.com

   New references:

   • https://github.com/andybalholm/brotli/releases/tag/v1.2.7
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://github.com/andybalholm/brotli/releases/tag/v1.2.7

   Source identifier: cve-coordination@google.com

4. 26.10.2026Record modifiedCVE Program

   New references:

   • http://www.openwall.com/lists/oss-security/2026/10/26/16
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	http://www.openwall.com/lists/oss-security/2026/10/26/16

   Source identifier: af854a3a-2127-422b-91ae-364da2661108

5. 26.10.2026Record modifiedCVE Program

   New references:

   • https://patchtheplanet.org/brotli
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://patchtheplanet.org/brotli

   Source identifier: af854a3a-2127-422b-91ae-364da2661108

Linked advisories

• Node2Shell puts Microsoft and Node.js on Brotli patch dutyCSO Online27.10.2026
• PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawThe Hacker News26.10.2026
• Multiple Node.js CVEsFortinet PSIRT26.10.2026
• Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used SoftwareThe Hacker News24.10.2026
• Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataThe Hacker News23.10.2026
• Vulnerabilities in node.js Affecting Cisco Products: October 2026Cisco PSIRT