Brotli Vulnerability CVE-2026-111497 (Node2Shell): What It Is and What to Patch
Published November 5, 2026. Details checked against the NVD record on November 5, 2026 (last modified November 4, 2026). Sources are linked at the end.
What Brotli is
Brotli is Google's compression format, the technology behind Content-Encoding: br in HTTP. Browsers, web servers, CDNs, and a large share of backend runtimes use it to make responses smaller. It is plumbing, not an application, and that is exactly why this vulnerability matters so much: one small library sits underneath a huge part of the internet.
The bug
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder (c/dec/decode.c), affecting Brotli versions 1.0.3 through 1.2.0. When the decoder hits an invalid block switch, it treats it as "I need more input" instead of a permanent format error, so the streaming decoder keeps appending bytes into an 8-byte internal buffer, past its end. The root cause is an unchecked return value in block-switch processing (CWE-252).
A remote, unauthenticated attacker sending a crafted Brotli-compressed stream can corrupt decoder memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.
Severity
- CVSS 4.0: 9.2 Critical (scored by Google)
- CVSS 3.1: 9.8 Critical (scored by NVD)
- CISA KEV: added to the Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10, 2026 remediation deadline for US federal agencies. Public proof-of-concept code exists.
Affected and fixed versions
- Google Brotli 1.0.3–1.2.0 affected; fixed in 1.0.10, 1.1.1, 1.2.1
- Node.js: below 22.23.4, 23.x below 24.22.1, 25.x below 26.12.1 affected; fixed in 22.23.4, 24.22.1, 26.12.1
- Python: brotli below 1.2.1 and brotlicffi below 1.2.1.0 affected; fixed in brotli 1.2.1 and brotlicffi 1.2.1.0
- .NET: fixed in 8.0.33, 9.0.22, 10.0.14
- Envoy: fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12; Istio: 1.31.2, 1.30.6, 1.29.9; Bun: 1.4.4
Timeline
- October 21, 2026: public disclosure. Node.js published its security releases and Google released Brotli 1.2.1 the same day. The flaw was reported by OpenAI Codex Security.
- October 27, 2026: CISA added CVE-2026-111497 to the KEV catalog.
- November 10, 2026: federal remediation deadline.
Why everyone is scrambling
Three reasons. First, the blast radius: anything that decompresses attacker-influenced Brotli data is exposed, from Node.js and Python services to Envoy, Istio, and countless devices that embed the library. Second, Brotli is embedded, not installed: every product that bundles the decoder needs its own fix release and redeploy, and some vendors are still shipping theirs. Third, scanners missed the Python side at first: the CVE was filed against Google's C library, and the PyPI packages were not listed in any advisory database as of October 23, so pip-audit and Dependabot had nothing to match against. The GitHub advisory covering them (GHSA-9v8h-qqgm-4m35) came later.
One nuance: exploitation is reportedly unreliable in practice. Most lab attempts crash the worker process instead of yielding a shell. So the realistic risk for most teams is crashes and denial of service first, remote code execution second, but with CISA listing it as exploited, nobody gets to wait and see.
What to check in your stack
- Node.js services and anything behind Envoy or Istio first.
- Python services using brotli or brotlicffi: these are easy to miss, since scanners did not flag them initially. Check installed versions directly.
- Any service that accepts request bodies with a Content-Encoding: br header, or that fetches and decompresses Brotli-encoded responses from external servers.
- If patching cannot happen immediately, a WAF can block crafted Brotli-compressed request bodies on the inbound side, but it cannot protect applications that fetch and decompress Brotli responses from elsewhere. Those must be patched.
No comments:
Post a Comment