CVE-2026-111497
9.2 critical
KEV · due 2026-11-10
exploit ×68
publicly disclosed
SSVC exploitation: active
Analyzed
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Fix
Microsoft's update · Critical · publicly disclosed
- Release Notes — azl3 brotli 1.1.0-2 on Azure Linux 3.0 · build 1.2.1-1
- KB5133964 — .NET 8.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS · build 8.0.427 · restart required
- KB5133965 — .NET 9.0 installed on Windows, .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS · build 9.0.320 · restart required
- KB5133966 — .NET 10.0 installed on Windows, .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS · build 10.0.403 · restart required
- Release Notes — .NET 11.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS · build 11.0.100-rc.3.26522.148 · restart required
- Release Notes — Microsoft Visual Studio 2019 version 16.11 · build 16.11.61 · restart required
- Release Notes — Microsoft Visual Studio 2022 version 17.14 · build 17.14.43 · restart required
- Release Notes — Microsoft Visual Studio 2026 version 18.11 · build 18.11.2 · restart required
- Release Notes — Microsoft Visual Studio 2026 version 18.12 · build 18.12 Insiders 3 · restart required
- Release Notes — PowerShell 7.6 · build 7.6.9
- Release Notes — PowerShell 7.5 · build 7.5.13
- Release Notes — PowerShell 7.4 · build 7.4.22
- Release Notes — azl3 nodejs 24.21.0-1 on Azure Linux 3.0 · build 24.22.1-1
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation More Likely.
Public exploits 68
- 0xBlackash/CVE-2026-111497 PoC on GitHub
- AdapptOnAzure/CVE-2026-111497-DotNetBrotliScan PoC on GitHub
- AdapptOnAzure/cve-2026-111497-mitigation PoC on GitHub
- AmanSin001/node-brotli-check PoC on GitHub
- Arkango/CVE-2026-111497 PoC on GitHub
- Blackman99/lotstamp PoC on GitHub
- CaterMaoZi/CVE-2026-111497-POC PoC on GitHub
- Charlie-Netdevops/node-hostcheck PoC on GitHub
- CompleTetech-Security/http2shell-check PoC on GitHub
- CompleTetech-Security/node2shell-check PoC on GitHub
- FranklinF25/http2shell PoC on GitHub
- Ghost-Bx1/DotNet-HTTP2Shell-CVE-2026-111497 PoC on GitHub
- Ghost-Bx1/Node2Shell-CVE-2026-111497 PoC on GitHub
- GlobularOne/HTTP2Shell-PoC PoC on GitHub
- Hika-sec/http2shell-CVE-2026-111497 PoC on GitHub
- Nyamort/brotli-pingback-lab PoC on GitHub
- SYM01/cve-2026-111497 PoC on GitHub
- Sami-AlEsh/nodejs-security-check PoC on GitHub
- Secragon/node2shell-radar PoC on GitHub
- TahuCryptsi/brotli-distro-check PoC on GitHub
- and 48 more
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2026-11-10
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Added to the catalog 2026-10-27. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/dotnet/announcements/issues/494 Issue Tracking, Mitigation, Third Party Advisory
Vendor advisories in the News 4
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026 Cisco Security Advisories · 2026-10-28
- CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL) Palo Alto Networks Security Advisories · 2026-10-26
- Node2Shell CVEs Fortinet PSIRT Advisories · 2026-10-26
- Microsoft October 2026 Security Updates: 1476 CVEs, 1 exploited, 96 critical Microsoft Security Update Guide · 2026-10-13
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 10
- I recreated a Node2Shell (CVE-2026-111497) RCE attack in the form of an interactive exercise r/blueteamsec · 2026-10-28
- CISA Confirms Active Exploitation of Node2Shell / HTTP2Shell r/cybersecurity · 2026-10-28
- U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog Security Affairs · 2026-10-28
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges The Hacker News · 2026-10-28
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA advisories and alerts · 2026-10-27
- Microsoft releases emergency .NET security fixes for Google Brotli bug The Register · Security · 2026-10-26
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw The Hacker News · 2026-10-26
- CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder Rapid7 blog · 2026-10-26
- Node2Shell: Brotli Decoder RCE in Node.js (CVE-2026-111497) r/cybersecurity · 2026-10-26
- CVE-2026-111497, node2shell Detection Opportunities r/blueteamsec · 2026-10-25
Change history 48
- EPSS0.55 → 0.88
- Cpes+26 CPE criteria (now 26)NVD modified 2026-10-28 17:47
- StatusPublished → AnalyzedNVD modified 2026-10-28 17:47
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-28 03:55
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-28 04:17
- EPSS0.36 → 0.55
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-27 19:59
- References+2 references (now 18)NVD modified 2026-10-27 20:17
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-27 20:17
- CISA KEVadded to CISA KEV, due 2026-11-10
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 14:58
- References+1 references (now 16)NVD modified 2026-10-27 15:16
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-27 15:16
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 18:10
- References+1 references (now 15)NVD modified 2026-10-26 18:17
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 18:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 13:06
- References+1 references (now 14)NVD modified 2026-10-26 14:16
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 14:16
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 04:03
- References+6 references (now 13)NVD modified 2026-10-26 05:17
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 05:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 03:11
- References+2 references (now 7)NVD modified 2026-10-26 04:17
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 04:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-24 18:07
- References+1 references (now 5)NVD modified 2026-10-24 18:16
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-24 18:16
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-24 03:55
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-24 04:18
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 21:40
- References+2 references (now 4)NVD modified 2026-10-23 23:17
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-23 23:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 21:40
- References+1 references (now 2)NVD modified 2026-10-23 22:16
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-23 22:16
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 14:25
- References-1 references (now 1)NVD modified 2026-10-23 14:17
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-23 14:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-23 13:44
- References+1 references (now 2)NVD modified 2026-10-23 13:17
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-23 13:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-22 13:35
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-22 19:17
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-22 13:35
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-22 16:18
- StatusReceived → PublishedNVD modified 2026-10-22 13:35
- First seenCVSS 9.2NVD modified 2026-10-22 14:17
Affected (CPE criteria) 26
cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*
References 18
- https://github.com/andybalholm/brotli/releases/tag/v1.2.7 Release Notes
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/25 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/24/6 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/12 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/13 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/26/16 Mailing List, Third Party Advisory
- https://broccoli2shell.com Third Party Advisory
- https://github.com/advisories/GHSA-9v8h-qqgm-4m35 Third Party Advisory
- https://github.com/dotnet/announcements/issues/494 Issue Tracking, Mitigation, Third Party Advisory
- https://github.com/google/brotli/releases/tag/v1.0.10 Release Notes
- https://github.com/google/brotli/releases/tag/v1.1.1 Release Notes
- https://github.com/google/brotli/releases/tag/v1.2.1 Release Notes
- https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html Mailing List, Third Party Advisory
- https://patchtheplanet.org/brotli Third Party Advisory
- https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 Third Party Advisory
- https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 US Government Resource