CVE-2026-111497

Name of the Vulnerable Software and Affected Versions Google Brotli versions 1.0.3 through 1.2.0 Node.js versions prior to 22.23.4 Node.js versions prior to 24.22.1 Node.js versions prior to 26.12.1 Python Brotli versions prior to 1.2.1 Python brotlicffi versions prior to 1.2.1.0 .NET (affected versions not specified) Bun (affected versions not specified) Envoy (affected versions not specified) Istio (affected versions not specified)

Description A buffer overflow exists in the Brotli decoder c/dec/decode.c due to a missing return value check. A remote unauthenticated attacker can exploit this by sending a specially crafted Brotli-compressed stream, which causes an invalid block switch that the decoder misinterprets as a request for more input. This leads to data being written beyond the limits of an internal eight-byte buffer, corrupting adjacent decoder state memory. This flaw, nicknamed Node2Shell or HTTP2Shell, can result in a denial of service, disclosure of sensitive memory contents, privilege escalation, or remote code execution. The issue affects various HTTP clients and servers that decompress Brotli data, including those in Node.js, Python, and .NET environments. Real-world scanning and exploit attempts have been observed.

Recommendations Update Google Brotli to version 1.0.10, 1.1.1, or 1.2.1. Update Node.js to version 22.23.4, 24.22.1, or 26.12.1. Update Python Brotli to version 1.2.1. Update Python brotlicffi to version 1.2.1.0. For .NET, apply the emergency updates released on October 25. As a temporary mitigation for Python applications, remove Brotli support. As a temporary mitigation, block incoming Brotli-compressed requests at the proxy server or firewall level.