cyber.hendryadrian.com
Vulnerability & Exploit · sophos.com

Node2Shell Brotli Vulnerability CVE-2026-111497 Reported in Active Exploitation

· Original article ↗

Summary

CVE-2026-111497, a critical buffer overflow in the Brotli decoder, could enable memory disclosure, denial of service, or remote code execution. Active exploitation has been reported, and CISA added it to its KEV Catalog.

Key points

  • CVE-2026-111497 affects the Brotli decoder; the article gives it a CVSS score of 9.2 and says it is also called Node2Shell, Broccoli2Shell, and HTTP2Shell.
  • Successful exploitation could cause memory disclosure, denial of service, or remote code execution.
  • Active exploitation has been reported; CISA added the CVE to its Known Exploited Vulnerabilities Catalog on October 27, 2026.
  • Node.js and multiple other vendors, including Microsoft and PHP, have published updates addressing the vulnerability.
  • CTU researchers recommend identifying vulnerable Brotli libraries or binaries, evaluating potentially affected products, and updating as appropriate.

Article Details

Vulnerability Types
  • Buffer overflow
Severity
Critical (CVSS 9.2)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-111497Node.js released updates to address multiple vulnerabilities, including an issue in Brotli decoder (CVE-2026-111497). This critical buffer overflow vulnerability (CVSS score of 9.2) has become widely known as

Vendors

Googleto Broccoli2Shell and HTTP2Shell. The issue exists in the Brotli decoder (c/dec/decode.c) in multiple Google Brotli versions, and products that rely on Brotli implementations are vulnerable. Successful exploitationMicrosoftshould evaluate what products in their environments could be at risk. Multiple vendors, including Microsoft and PHP, have published updates to address this vulnerability in their products. PHPevaluate what products in their environments could be at risk. Multiple vendors, including Microsoft and PHP, have published updates to address this vulnerability in their products. 

Products

BrotliOn October 21, 2026, Node.js released updates to address multiple vulnerabilities, including an issue in Brotli decoder (CVE-2026-111497). This critical buffer overflow vulnerability (CVSS score of 9.2) has becomeNode.jsOn October 21, 2026, Node.js released updates to address multiple vulnerabilities, including an issue in Brotli decoder (CVE-2026-111497). This critical buffer overflow vulnerability (CVSS score of 9.2) has become

Related Articles