Oct 26 2026 8 minute read
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.
Key Takeaways
- CVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Google's Brotli decoder library that Google, the CVE Numbering Authority (CNA), scored 9.2 under CVSSv4.0.
- Any application that decompresses attacker-controlled data with a vulnerable Brotli decoder is potentially at risk, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse.
- Patches are available for Google Brotli and the major runtimes, though some projects had not shipped a fixed release as of October 26, and applications that bundle their own copy of Brotli each need their own fix.
Background
Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Brotli2Shell, a vulnerability in Google's Brotli C decoder library, which Node.js, .NET and other software embed.
FAQ
What is Brotli2Shell?
Brotli2Shell is one of several names for CVE-2026-111497, a memory corruption flaw in Google's open-source Brotli compression library. Some researchers call it Node2Shell, after Node.js, which disclosed the flaw in its October 21 security advisory. Others use HTTP2Shell, since the same bug reaches HTTP software outside Node.js. It has circulated as Broccoli2Shell as well. We use Brotli2Shell because the bug sits in the Brotli decoder itself, not in any one downstream product.
What is the vulnerability associated with Brotli2Shell?
CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli C decoder library.
An attacker can trigger the flaw by getting an application to decompress crafted Brotli data. Two common paths are a compressed HTTP response sent to a client that decompresses it automatically, and a compressed request body sent to a server that decompresses incoming content. The impact ranges from a process crash to potential remote code execution, and the bug can also leak process memory.
Note on severity scoring: Google, as the CNA, scored the flaw 9.2 (CVSSv4.0) with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Microsoft rates it 8.1 (CVSSv3.1) for .NET.
When was CVE-2026-111497 first disclosed?
Google committed the upstream fix to the Brotli source repository on February 27. Node.js publicly disclosed the vulnerability on October 21 in its security advisory, the same day Google released fixed Brotli versions. Envoy Proxy and Istio had already shipped fixed releases earlier in October without naming the flaw. NVD published the CVE record on October 22. Brotli 1.2.1 and brotlicffi 1.2.1.0 both reached the Python Package Index (PyPI) on October 22. On October 25, Microsoft released .NET security updates.
What software is affected by CVE-2026-111497?
The risk applies wherever an application decompresses Brotli data an attacker can control, whether that data arrives over HTTP in either direction or inside a file.
Node.js release lines that have reached end of support, including 20, 23 and 25, do not receive a fixed release. Akamai said its telemetry "shows that 61% of networks are running affected Node.js versions."
JFrog Security Research showed that the flaw also reaches FFmpeg through the libjxl library, by way of Brotli-compressed metadata in JPEG XL files. JFrog obtained instruction-pointer control in FFmpeg with a crafted JPEG XL file but did not demonstrate code execution. The same research produced an infinite-loop denial of service in Apache Arrow, which uses Brotli for compressed Parquet data, with a crafted 534-byte input, and crashed a tested ClickHouse server with a single malformed Brotli-compressed HTTP request. Python HTTP clients such as urllib3, requests, httpx and aiohttp are also in scope when the Brotli or brotlicffi package is installed.
Does updating the system Brotli library fix the issue?
It depends on where the software gets its decoder. Programs that load the operating system's copy of Brotli pick up the fix once they restart. Node.js, Bun and other applications that ship with a built-in copy keep the flawed decoder until a fixed release of that application is installed.
Is every .NET, Envoy Proxy or Istio installation exposed?
No. These platforms are exposed only when Brotli decompression is in use.
.NET: Microsoft says an application "is not exposed merely because an affected .NET package is installed," and ASP.NET Core request decompression and HttpClient automatic response decompression are off by default. Applications are in scope when they use ASP.NET Core request decompression, HttpClient response decompression, or the Brotli APIs in System.IO.Compression such as BrotliStream and BrotliDecoder. NativeAOT and self-contained applications pick up the fix only when they are rebuilt and redeployed. Microsoft says .NET Framework is not affected.
Envoy Proxy and Istio: Envoy Proxy is exposed only when its Brotli decompressor is configured, and Istio users are potentially affected when they enable Brotli decompression, for example through an EnvoyFilter. Istio 1.29 reached end of support on October 15. Its 1.29.9 release includes the fix.
Is PHP affected by CVE-2026-111497?
PHP's official Windows builds are affected, because they include their own copy of Brotli. On October 26, PHP released updated Windows builds that bundle Brotli 1.2.1. PHP names its cURL extension as the route to the flaw in those builds, once automatic decompression of HTTP responses is enabled. cURL keeps that setting off unless an application or HTTP client library enables it. On other platforms, PHP can still reach a vulnerable decoder through the system Brotli library or through the PHP brotli extension, which bundles its own copy and fixed the flaw in version 0.21.1. The PHP source releases are unchanged, and this flaw is separate from the PHP2Shell vulnerabilities covered in our FAQ.
Is CVE-2026-111497 being exploited in the wild?
On October 26, threat intelligence firm ELLIO reported that its sensors recorded an exploitation attempt against CVE-2026-111497. ELLIO said the attempt targeted Node.js 24.22.0 on x86-64 and combined code copied from public PoCs with an original exploit chain. Tenable has not independently confirmed this activity. As of October 26, the vulnerability is not in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Has Tenable Research classified this vulnerability as part of Vulnerability Watch?
Yes. CVE-2026-111497 has been classified as a “Vulnerability of Interest” as part of Vulnerability Watch.
Is there a proof-of-concept (PoC) available for CVE-2026-111497?
Yes. Public PoCs for CVE-2026-111497 are available on GitHub. The Imperva Red Team demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image after multiple attempts, and has not released that exploit. At least one public PoC on GitHub claims code execution against Node.js 24.22.0 under narrow lab conditions. ELLIO said it reproduced code execution against the official Node.js 24.22.0 build on x86-64.
Are patches or mitigations available for CVE-2026-111497?
Fixed versions for Google Brotli, Node.js, Bun, Envoy Proxy, Istio, .NET, the Python Brotli packages and PHP for Windows are listed in the table above. As of October 26, ClickHouse had merged a fix without shipping a release, and the Apache Arrow issue remained open.
Patching does not reach code that is already running. The fixed decoder takes effect in a process or scheduled job only after a restart, and in a container only after its image is rebuilt and redeployed.
Where patching is delayed, the Patch the Planet mitigation guide and the tracker list temporary steps that reduce exposure:
- Blocking requests marked Content-Encoding: br at the proxy or load balancer, so they stop before anything decompresses them. This step does nothing for applications that fetch Brotli responses from attacker-controlled servers, and turning off Brotli compression on an origin server or CDN has no effect on decompression.
- Turning off Brotli decoding in HTTP clients. Taking br out of the Accept-Encoding header falls short by itself, since a hostile server can still reply with Brotli-encoded data.
- Disabling the Brotli decompressor filter in Envoy Proxy and Istio in both directions. A disabled filter forwards compressed bytes as they arrive, which leaves any downstream service that decodes Brotli at risk.
- Removing the Brotli or brotlicffi package from Python environments until a patched version is in place.
Are there any indicators of compromise for CVE-2026-111497?
ELLIO published the source IP address and a payload hash for the exploitation attempt it observed. They are available in ELLIO's blog post.
Has Tenable released product coverage for CVE-2026-111497?
A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2026-111497 as they're released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Get more information
Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
