cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Node2Shell Brotli Flaw Prompts Patches Across Microsoft, Node.js and Python

· Original article ↗

Summary

CVE-2026-111497, an out-of-bounds write in Brotli 1.0.3–1.2.0, could cause crashes, memory leaks or code execution. Patches are available across several projects; no in-the-wild exploitation has been reported.

Key points

  • The flaw affects Brotli versions 1.0.3 through 1.2.0; fixed releases include 1.0.10, 1.1.1 and 1.2.1.
  • Crafted input reaching the vulnerable decoder can cause memory corruption, potentially leading to a crash, memory-content disclosure or unauthenticated code execution.
  • Imperva demonstrated code execution on a tested Node.js 24.22.0 Linux arm64 image, but said the result did not succeed on every attempt and has not released its exploit.
  • Microsoft, Node.js, the Brotli and brotlicffi Python packages, Bun, Envoy and Istio have received updates.
  • No exploitation in the wild has been reported. A published proof of concept reportedly achieves code execution only against an intentionally weakened build.
  • Some projects that bundle Brotli, including DuckDB and Apache Arrow, were listed as potentially unpatched; the tracker is incomplete and exposure depends on configuration.
  • Affected services may need restarting, and container images rebuilding, to ensure they use patched code.

Article Details

Vulnerability Types
  • Out-of-bounds write
Severity
Critical; Google assigned CVSS v4 9.2. Microsoft assigned CVSS v3.1 8.1, rating it critical for .NET and Visual Studio and important for PowerShell.
Affected Versions
  • Brotli 1.0.3 through 1.2.0
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationImperva demonstrated code execution by sending malicious Brotli data in a request body processed by an application; the article also describes exposure through compressed HTTP request bodies.

CVE

CVE-2026-111497A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages.

Vendors

GoogleA vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages.MicrosoftA vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages.

Products

.NETNode.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell.BrotliA vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages.brotlicffiIn Python’s case, the vulnerable decoder is built into two PyPI packages, Brotli and brotlicffi.BunBun, Envoy and Istio have also been updated.EnvoyBun, Envoy and Istio have also been updated.IstioBun, Envoy and Istio have also been updated.Node.jsA vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages.PowerShellNode.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell.Visual StudioNode.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell.

Related Articles