CVE-2026-111497

CVE Enrichment

CISA KEV: Not listed

Last enrichment sync: 22-Oct-2026 18:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (7)

Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially causing a crash, a memory leak, or the execution of Brotli Flaw Affects Node.js, Bun, Python Packages and Envoy; RCE Shown on One Node.js Build
Node.js has released security updates addressing CVE-2026-111497, a high-severity vulnerability in its bundled Brotli decompression code that can potentially enable remote code execution. Node.js Patches Brotli Flaw That Could Enable Remote Code Execution
arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw and released fixes on October 21, and applications that decode untrusted Researchers Demonstrate Node2Shell RCE on Official Node.js Build via Crafted Brotli Data
CVE-2026-111497 (“Node2Shell”) is a vulnerability in Google’s Brotli C decoder, not in Node.js. Node2Shell Vulnerability Also Affects Python Brotli Packages
Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can Brotli CVE-2026-111497 Affects Python and HTTP Libraries

CVE (3)

People (5)

MITRE ATT&CK (2)

Vendors (13)

Products (13)

Tools (6)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.