Brotli Vulnerability (CVE-2026-111497): One Library Flaw Hits Node.js, .NET, Python and More

A single bug in Google's Brotli compression library — tracked as CVE-2026-111497 and nicknamed Node2Shell, Brotli2Shell and HTTP2Shell — lets an attacker corrupt memory in any program that decompresses attacker-controlled Brotli data, potentially leading to remote code execution. Because Brotli is embedded in Node.js, .NET, Python, Bun and a long list of other software, one upstream flaw became a patch scramble across the entire stack in late October 2026. If your service accepts a Content-Encoding: br request body or decodes Brotli from any untrusted source, you need to patch.

This is not another single-product CVE. The Brotli vulnerability sits in the shared C decoder that dozens of runtimes bundle, so the interesting question isn't "is Node.js affected?" (it is) but "which of the things I run quietly link the same library?" This piece maps the full blast radius and gives you the fixed version for each ecosystem in one table.

What is CVE-2026-111497?

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. According to Node.js's security release notes, the streaming decoder kept appending input bytes into an eight-byte internal buffer without bounds-checking, so specially crafted Brotli-compressed data overflows that buffer and corrupts process memory. The practical outcomes are a crash, disclosure of process memory, or in the worst case remote code execution. Google scored the flaw 9.2 under CVSS v4.0, while Singapore's Cyber Security Agency cited a CVSS v3.1 score of 9.8 — either way, critical. The only precondition is that a vulnerable application decompresses Brotli data an attacker can influence, which is a very common pattern: Brotli (br) is a standard HTTP content encoding supported by every mainstream browser and CDN.

Why one bug hits so many products

Brotli shipped as a small, fast C library that application runtimes vendor directly rather than depend on at the OS level. That design is why the fix had to be re-released by each project instead of patched once. Security vendor Field Effect notes the flaw reaches multiple ecosystems at once, and Tenable's advisory lists a blast radius that includes Python, Bun, .NET, Java's brotli4j, the Envoy proxy and Istio service mesh, plus data tooling like FFmpeg, Apache Arrow and ClickHouse. This is the same "one flaw, many stacks" shape we covered with the HTTP/2 Bomb that crashed nginx, Apache and IIS: a shared primitive everyone trusted, failing everywhere simultaneously. It also rhymes with the dependency-level risk behind the npm supply-chain crisis of 2026 — the code you never chose to install is still your attack surface.

Patch matrix: fixed versions by ecosystem

Update to the versions below. If you run containers or CI images, rebuild them — a patched base image is the fastest way to fix bundled runtimes in one move.

Ecosystem	Fixed version(s)	Notes
Google Brotli (C library)	1.0.10, 1.1.1, 1.2.1	The upstream source of the bug; everything else re-bundles this
Node.js	22.23.4, 24.22.1, 26.12.1	Fixed via node:zlib in the Oct 21 release; 20.x is EOL and will not be patched
.NET	8.0.33, 9.0.22, 10.0.14	Apply the October runtime update
Python (brotli / brotlicffi)	1.2.1 / 1.2.1.0	Common in HTTP clients that negotiate br encoding
Bun	1.4.4	Bundles its own Brotli decoder
brotli4j, Envoy, Istio, FFmpeg, Apache Arrow, ClickHouse, PHP for Windows	Per vendor advisory	All link the same decoder — check each project's release notes

Am I actually exposed?

Installing a vulnerable runtime is not the same as being exploitable. The exposure test is simple: does your code ever decompress Brotli data that an attacker can supply? Ask these three questions, in order:

• Do you accept Brotli request bodies? An API or proxy that honors Content-Encoding: br on inbound requests is the classic exposed path — the attacker controls the compressed bytes directly.
• Do you fetch and decompress remote content? Server-side HTTP clients, webhook consumers, and scrapers that let the server send br-encoded responses are exposed if the remote end is untrusted.
• Do you decompress user-uploaded or stored files through a Brotli path? Build pipelines, document processors and data tools (Arrow, ClickHouse, FFmpeg) that ingest .br streams count.

If the answer to all three is no — for example, you only ever compress outbound responses and never decode untrusted Brotli — your practical risk is lower, but patch anyway. Rapid7's analysis stresses that decoder paths are easy to reach indirectly through libraries you didn't realize negotiate br, so "I don't think I use Brotli" is not a safe assumption.

Timeline: an eight-month gap

The most uncomfortable detail is the delay. The fix was committed to the upstream Brotli repository on 27 February 2026, but the fixed library releases did not ship until 21 October 2026 — roughly eight months during which the patch sat in public source history while released binaries stayed vulnerable. Datadog Security Labs reproduced the bug as Node2Shell, and by the time coordinated disclosure landed on 30 October a proof-of-concept was public and the flaw was reportedly being actively exploited. A public upstream commit is a roadmap for attackers; the window between "fixed in source" and "shipped to users" is exactly where this one became dangerous. It's the same patch-latency lesson behind our writeup of the worst patch week of 2026.

What to do now

Treat this as a same-day job on any internet-facing service. Patch runtimes to the versions in the table, rebuild and redeploy container images so bundled copies are refreshed, and restart workloads — an in-memory process keeps running the old vulnerable decoder until it restarts. After patching, review access and request logs for the exposed paths above; memory-corruption exploits often leave crash loops or abnormal restarts before they succeed. If you manage your own infrastructure, our secure-first-hour VPS checklist covers the logging and update hygiene that make the next one of these a routine patch rather than a fire drill.

FAQ

Is CVE-2026-111497 being exploited? A proof-of-concept is publicly available and the vulnerability is reportedly being actively exploited as of late October 2026. Combined with the critical severity and the huge install base, that puts it firmly in "patch now" territory.

Which Node.js versions are fixed? Node.js 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026. Node.js 20.x reached end of life on 30 April 2026 and will not receive a fix — move off it.

I only compress responses, I never decompress Brotli. Am I safe? Your direct risk is lower because the bug is in the decoder, not the encoder. But libraries and HTTP clients can negotiate and decode br without you noticing, so patch regardless rather than relying on that assumption.

Does patching the OS fix it? Usually not by itself. Most affected software bundles its own copy of Brotli, so you must update each runtime (Node.js, .NET, Bun, Python packages) and rebuild container images — an OS package update alone won't refresh a vendored library.

Sources

• Node.js — October 2026 Security Releases: official patched versions (22.23.4, 24.22.1, 26.12.1), the out-of-bounds-write mechanism, and the 10-CVE release.
• Tenable — Brotli2Shell FAQ (CVE-2026-111497): CVSS v4.0 9.2 score, affected ecosystems, and fixed Brotli/Python/Bun/.NET versions.
• Datadog Security Labs — Node2Shell: technical reproduction and the Feb-to-Oct 2026 fix timeline.
• Rapid7 — Critical out-of-bounds write in the Node.js Brotli decoder: exposure analysis and why decoder paths are easy to reach indirectly.
• CSA Singapore — Active Exploitation of Critical Brotli Vulnerability: CVSS v3.1 9.8 score, active-exploitation and PoC status, affected products.
• Field Effect — Brotli vulnerability affects multiple software ecosystems: the cross-ecosystem blast radius.