Brotli bug reaches far beyond Node.js (CVE-2026-111497)
Our summary
A newly disclosed flaw in Google's Brotli compression library, tracked as CVE-2026-111497 and nicknamed "Node2Shell"/"Broccoli2Shell"/"Brotli2Shell," is a remotely triggerable out-of-bounds write that can crash processes, leak memory, or enable remote code execution when an app decompresses attacker-supplied Brotli data. Node.js disclosed the bug on October 21, 2026, after a fix sat unreleased in the google/brotli repository for eight months; patched Brotli versions 1.2.1, 1.1.1 and 1.0.10 only shipped last week, alongside fixed Node.js releases 26.12.1, 24.22.1 and 22.23.4 (the end-of-life 20.x, 23.x and 25.x branches won't be patched). Because Brotli is embedded in many other projects, researchers warn the exposure extends to .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse, with most maintainers now rolling out updated dependencies. Proof-of-concept RCE exploits are public, and security firm ELLIO has detected real-world exploitation traffic from an IP previously linked to mass-scanning campaigns, suggesting the bug is already being weaponized at scale.
Help Net Security publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.