Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-111497 Brotli flaw: patched Node.js, .NET and Python versions

A buffer overflow in Google's Brotli decoder, nicknamed Node2Shell, is being fixed in Node.js, .NET, Python and other software that bundles it; here is what to update and how to check.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How far it reaches
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

A memory-corruption flaw in Google's Brotli decompression library, tracked as CVE-2026-111497 and nicknamed "Node2Shell" (also "HTTP2Shell" and "Broccoli2Shell"), is being patched across the software that bundles it. Node.js shipped fixes on 21 October, Python packages followed on 23 October, and on 25 October Microsoft released out-of-band updates for .NET 8, 9 and 10. Because Brotli is compiled into runtimes, proxies and libraries, updating one copy does not fix the others, so the work is to find every copy you run.

Key points

  • CVE-2026-111497 is a buffer overflow in the Brotli decoder: a crafted compressed stream makes the decoder keep appending input to an eight-byte internal buffer and write past its end (Node.js advisory).
  • Fixed versions: Node.js 22.23.4, 24.22.1 and 26.12.1; .NET 8.0.33, 9.0.22 and 10.0.14 (plus .NET 11 RC3); Python Brotli 1.2.1 and brotlicffi 1.2.1.0 (BleepingComputer, Microsoft).
  • Proof-of-concept exploits are public, and Imperva reports remote code execution on an official Node.js build; no malicious exploitation has been reported (BleepingComputer, The Register).
  • The upstream fix was committed in February but no Brotli release carried it until October, so downstream projects had nothing to ship.
  • In .NET the exposed paths are not on by default: ASP.NET Core request decompression, HttpClient automatic response decompression and the Brotli APIs in System.IO.Compression. .NET Framework is not affected.

What to do

Who is affected. Anything that decompresses Brotli data an attacker can influence: web servers that accept Content-Encoding: br requests, and any HTTP client that fetches attacker-controlled URLs and decodes Brotli responses. Node.js 22, 24 and 26 are affected, per the Node.js advisory. Python HTTP stacks that use urllib3 with the brotli extra, requests, httpx or aiohttp with speedups are exposed when they use a vulnerable decoder, according to BleepingComputer. Vulnerable Brotli library versions are 1.0.3 through 1.0.9, 1.1.0 and 1.2.0; patched upstream releases are 1.0.10, 1.1.1 and 1.2.1.

How to fix it.

  1. Node.js: move to 22.23.4, 24.22.1 or 26.12.1, then restart the process.
  2. .NET: install 8.0.33, 9.0.22, 10.0.14 or .NET 11 RC3. Framework-dependent apps need the new runtime and a restart. Self-contained apps must be rebuilt and republished, because installing a runtime on the host does not change the one bundled in your app. Containers need rebuilt images. Check installed runtimes with dotnet --list-runtimes.
  3. Python: upgrade Brotli to 1.2.1 or brotlicffi to 1.2.1.0, then rebuild images.
  4. Everything else that bundles Brotli (Bun, Envoy and Istio have shipped patches; check your reverse proxies, gateways and vendored copies): do not assume the system library covers a runtime that carries its own copy.

If you cannot patch yet. BleepingComputer reports the guidance to remove Brotli support from Python applications and to block inbound Brotli-compressed requests at the proxy or firewall. Blocking requests does not close the response route: a malicious server can still send a Brotli-compressed response to an application that fetches its URL. The Register reports that OpenAI's Patch the Planet advisory likewise recommends blocking untrusted Brotli data where practical until patches are applied.

What happened

Node.js published its October security releases on 21 October, fixing ten vulnerabilities. The most serious, per The Register, was CVE-2026-111497, credited to Khai Tran and Sylvie Mayer of OpenAI's Codex Security, with fixes by Matteo Collina and Antoine du Hamel. The advisory describes the bug precisely: an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. An attacker who can get an application to decompress such data through node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory or remote code execution. The Node.js project rates it "high".

Google's Brotli maintainers and the Python packaging ecosystem followed. According to BleepingComputer, Node.js and Google released stable fixes on 21 October and the flaw was disclosed publicly the next day, with the patched PyPI packages available on 23 October.

On 25 October Microsoft's Rahul Bhandari announced out-of-band updates because the issue touches .NET's use of Brotli. Microsoft's description says an unauthenticated attacker may read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege. Microsoft's advisory scores it 8.1 under CVSS v3.1 and assesses "Exploitation More Likely", while listing no known exploitation, The Register reports. Sources do not agree on severity labels: Node.js says "high", BleepingComputer calls the flaw critical, and we have not independently verified any other score.

Background

Brotli is a lossless compression format developed by Google and widely used for web content because it shrinks text more than gzip. Its decoder is a C library, and C decoders that parse untrusted input are a classic source of memory-safety bugs. The Register notes that the underlying defect was fixed in Brotli's source in February, but nobody then recognised it as a security vulnerability, and no new release followed. OpenAI said in a post on X, quoted by The Register, that the root cause "was actually fixed in the Brotli source code in February" without being known to be exploitable. That leaves a gap familiar from other library flaws: a fix sitting in a repository protects nobody until it is released and every embedding product takes it.

The disclosure also landed close to the PHP2Shell wave, which drew most of the attention that week; our coverage of its third, unpatched bug shows how crowded the advisory queue was. The Register says the Brotli flaw went "slightly under the radar" for that reason.

How far it reaches

The attack surface is wider than web servers. The Register reports that JFrog built an exploit against FFmpeg using a specially crafted JPEG XL image: FFmpeg reaches Brotli through libjxl, which decompresses metadata stored in brob boxes in the format. The same researchers say Apache Arrow is affected too, where attackers can cause denial of service. BleepingComputer points out that the flaw is not specific to HTTP/2, despite the "HTTP2Shell" nickname, and that a dedicated impact-tracking portal warns system-library updates do not cover bundled copies.

Cloud exposure may be large. Wiz researcher Merav Bar told The Register that 91 percent of cloud environments rely on components vulnerable to the Brotli flaw and that 82 percent have publicly exposed Node.js instances. These are Wiz's own figures, and "rely on a vulnerable component" is not the same as "exploitable".

Share of cloud environments exposed, as reported by Wiz%
Share of cloud environments exposed, as reported by Wiz (%)
%
Rely on Brotli-vulnerable components91
Have publicly exposed Node.js instances82

Source: Wiz via The Register

What it means

For developers, the main lesson is inventory. A Node.js service, a .NET container and a Python worker can each carry a separate Brotli decoder, and only a rebuild of each picks up the fix. Teams that pin base images or ship self-contained binaries have the most to do. For operators of proxies and gateways, the quick mitigation of rejecting Content-Encoding: br helps for inbound traffic but should be tested route by route, including paths that reach the origin directly.

For the ecosystem, the story repeats a pattern: a bug found by an AI-assisted code-security team, fixed quietly months earlier, and made real only by coordinated releases across many projects. Microsoft also used the same release to re-issue advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) and CVE-2026-102870 (Blazor WebAssembly debugger), because its 13 October release did not fully address them, and to fix CVE-2026-114148, a Linux tarball ownership flaw. Anyone who patched .NET on 13 October therefore still needs these builds.

What we don't know yet

  • Whether anyone is exploiting the flaw. Both BleepingComputer and The Register say there are no reports of malicious exploitation, but public proofs of concept exist.
  • Which other products bundle Brotli. The list of vendors who have shipped patches (Node.js, Bun, Envoy, Istio, .NET, Python packages) is still growing, and we could not confirm a complete list.
  • The right severity number. Different vendors publish different scores and labels, and the authoritative record for .NET is Microsoft's Security Update Guide.

What to watch next

Expect more downstream releases (container base images, language runtimes, gateways), vendor advisories listing bundled Brotli, and reports of scanning once exploit code spreads. Watch the Node.js, .NET and Brotli release pages, and CISA's known-exploited list for any change in exploitation status.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next