Do Son 
TL;DR
CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, versions 1.0.3 through 1.2.0. Because Brotli is bundled into runtimes, proxies, appliances and file tools, this Brotli vulnerability reaches far beyond one library. This page tracks the affected products, which have fixes and which are still waiting.
- CVE: CVE-2026-111497
- CVSS: 9.2 (Critical · CVSSv4)
- Product: Google Brotli
- Affected: 1.0.3, 1.1.0, 1.2.0
- Impact: Out-of-Bounds Write in Google Brotli Decoder
- Status: Exploited in the wild
- Patched in: 1.0.10, 1.1.1, 1.2.1
- EPSS: 82.6% (30-day)
- Action: Update to 1.0.10, 1.1.1, 1.2.1 now
Why It Matters
CISA added the Brotli vulnerability to its Known Exploited Vulnerabilities catalog on October 27, 2026. Federal agencies must patch by November 10. CISA lists it as an unchecked return value flaw. Its entry says a remote attacker can “corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.”
Google scores the flaw 9.2 on CVSS v4, while Red Hat rates it 8.1. Researchers have nicknamed it Broccoli2Shell, also called Node2Shell or HTTP2Shell. Moreover, Wiz reports that 91% of cloud environments have resources vulnerable to it.
Exploitation status
Field Effect cites a single threat intelligence source that reported an exploitation attempt against Node.js 24.22.0. No second source has confirmed it so far.
Meanwhile, researchers have shown the risk is real. Imperva says it reached code execution on Node.js 24.22.0, but it has not released its exploit. JFrog also showed crashes and loops in ClickHouse and pyarrow. Red Hat, in contrast, says it knows of no reliable public proof of concept for running code.
How the bug works
The flaw sits in the decoder, so any software that decompresses untrusted Brotli data may be exposed. That includes HTTP clients that decode compressed responses, proxies that inspect traffic, and tools that open compressed files. Exposure often depends on whether Brotli decompression is turned on.
Upstream Fix
- Google Brotli (C library): fixed in 1.0.10, 1.1.1 and 1.2.1
- Go (andybalholm/brotli): fixed in v1.2.7
Products With Fixes Available
Runtimes and frameworks
- Node.js: 22.23.4, 24.22.1 and 26.12.1, released October 21. Node.js 20.x and older lines are end of life.
- Bun: 1.4.4
- Microsoft .NET: 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3, released October 25. .NET Framework is not affected.
- PowerShell: 7.4.22, 7.5.13 and 7.6.9
- Visual Studio: 2019, 2022 and 2026 security updates released October 25
- PHP for Windows: rebuilds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 bundle Brotli 1.2.1. The bug is reachable through cURL only when automatic response decompression is on.
Language packages
- Python Brotli: 1.2.1
- Python brotlicffi: 1.2.1.0
- Ruby brotli gem: 0.9.1
Proxies and service mesh
- Envoy: 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Only setups with the Brotli decompressor configured are exposed.
- Istio: 1.29.9, 1.30.6 and 1.31.2, when Brotli decompression is enabled through an Envoy filter
Security and enterprise products
- Palo Alto Networks PAN-OS: 12.2, 12.1 and 11.2 are affected only when TLS decryption and Brotli inspection are both enabled. Hotfixes such as 12.2.4-h1 and 11.2.4-h23 are listed per branch. PAN-OS 11.1, 10.2 and Panorama are not affected.
- Prisma Cloud Application Security Transporter Client: 0.2.9
- MuPDF: 1.28.0
- cdxgen: 12.8.9 and 13.5.0
Linux distributions
- Red Hat Enterprise Linux 9: brotli 1.0.9-10.el9_8.1
- Debian: trixie 1.1.0-2+deb13u1 and bookworm 1.0.9-2+deb12u1
- Amazon Linux 2023: fixed brotli and Node.js 24 packages, shipped October 24
- openSUSE Tumbleweed: fixed brotli and Node.js 24 packages
Affected Products Without a Released Fix
- Broadcom VMware Cloud Foundation (SDDC Manager): Broadcom rates SDDC Manager 9.1.1 at CVSS 9.8. Versions 9.0.x, 9.1.0 and 5.2.x are rated 7.5. Patches are pending, so Broadcom points to workarounds in KB460732 and KB460734.
- ClickHouse: a backport to Brotli 1.2.1 merged into the 26.9 branch, but no release was confirmed at last check.
- DuckDB: fix in progress
- Apache Arrow C++: bundles Brotli 1.0.9 with no released fix
- libjxl and FFmpeg: rebuild against Brotli 1.2.1. FFmpeg can reach the bug when it decodes JPEG XL files through libjxl.
- Others with no released fix: NanaZip, GraalJS, Microsoft v8-jsi, 7-Zip-zstd, p7zip, EDK II and woff2 Makefile builds
Still being evaluated
- SUSE Linux Enterprise 15: Node.js 22 updates in testing
- Ubuntu: brotli and nodejs packages listed as needing evaluation
Not Affected
- Microsoft .NET Framework
- Palo Alto Networks PAN-OS 11.1 and 10.2, and Panorama
- PHP on Windows with cURL auto-decompression off, which is the default
What to Do Now
Most fixes for the Brotli vulnerability are already out, so the main task is finding every copy.
- Patch Node.js, .NET, Bun and other runtimes first, since they decompress untrusted web traffic.
- Update the system brotli package, then find statically linked or bundled copies in your software.
- Where no fix exists, turn off Brotli decompression if your product allows it.
- For Python apps, uninstall Brotli packages you do not need, so HTTP clients fall back to gzip.
- Cloudflare has added WAF rules, but they log only by default, so switch them to block.
Vendor details are in the Palo Alto Networks Brotli advisory, the Microsoft .NET advisory and the Canadian Cyber Centre alert. This list reflects vendor statements and public reporting as of November 1, 2026. We will update it as new fixes ship.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
