Core Vulnerability and Impact
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that can corrupt process memory. The flaw is remotely exploitable when an application decompresses attacker-controlled Brotli data. Depending on the target, the corruption can cause a crash, leak of process memory, or remote code execution. The issue was publicly disclosed by Node.js maintainers on October 21, 2026, after the fix had been committed to google/brotli on February 27, 2026 but not released until last week.
Affected Products and Versions
The vulnerability propagates through any software that bundles the vulnerable Brotli decoder. The most widely impacted runtimes are:
- Node.js 26.x, 24.x, and 22.x branches – patched in 26.12.1, 24.22.1, and 22.23.4.
- .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse.
- End-of-life lines 20.x, 23.x, and 25.x of Node.js remain vulnerable and will not receive a fix.
Linux distributions have released or are in the process of releasing packages that include the patched Brotli library. The library itself is now available in versions 1.2.1, 1.1.1, and 1.0.10.
Exploit Path and Real-World Use
Proof-of-concept code for CVE-2026-111497 is available on GitHub. Imperva demonstrated that the flaw can be leveraged to achieve remote code execution against the official Node.js 24.22.0 Linux arm64 image after multiple attempts. Threat-intelligence firm ELLIO reported that its sensors captured exploit traffic in the wild, using the public PoC to spawn a shell on vulnerable builds. The IP address 94.154.43.7, which has previously been linked to other exploitation campaigns, was identified as the source of these attempts.
The presence of an affected Brotli decoder does not automatically mean exposure; an application must process attacker-controlled Brotli data to be vulnerable. Rapid7 notes that exposure varies by product and that organizations should consult downstream vendor or distribution advisories to assess risk.
Detection and Containment
- Inventory – Identify all systems that use Brotli. Check library versions and Node.js releases.
- Patch – Apply the latest Brotli library (1.2.1, 1.1.1, or 1.0.10) and update Node.js to 26.12.1, 24.22.1, or 22.23.4. For other runtimes, follow the vendor’s patch schedule.
- Rebuild – Rebuild affected applications and container images with the patched dependencies.
- Redeploy – Restart services to ensure the patched components are in use.
- Verify – Run a memory-corruption scanner or the public PoC against the updated environment to confirm the vulnerability is mitigated.
Aikido Security recommends updating dependency locks, rebuilding images, redeploying, and restarting services. They also advise verifying that running workloads use the patched components.
Monitoring and Future Outlook
The vulnerability’s wide reach underscores the importance of timely patching for shared libraries. The delay between the fix commit and public release created a prolonged exposure window. Monitoring for exploit traffic, especially from known malicious IPs, remains prudent.
For more detailed technical guidance, see the dedicated Broccoli2Shell site and the Brotli Decoder Memory Corruption Enables RCE in Node.js, Bun, Python and More.
Sponsored: For a comprehensive view of CVE records, visit the NVD CVE records.
Related coverage
- PHP Releases Second Windows Update in Five Days to Patch PHP Brotli Flaw
- PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x