Science & Tech · Cybersecurity · 1 hr ago
Brotli flaw prompts security updates across software
A flaw in Google’s Brotli library can corrupt computer memory when software decompresses malicious data.
Brotli is used in many products, including Node.js, .NET, Python tools and other software, so the risk extends beyond one program.
Depending on how a product uses the library, an attack could crash it, expose information or run malicious code.
Software makers have released fixes for many affected products, including Node.js and .NET, while updates for some Linux distributions are being prepared.
Security reports disagree on whether attacks are already happening: some say exploit traffic has been seen, while others report no confirmed real-world exploitation.
Organizations should install the relevant updates, then rebuild affected applications and container images, redeploy them and restart services so the fixes take effect.
CVE-2026-111497 is a buffer overflow flaw in Google’s Brotli decompression library that can affect software across multiple ecosystems.
Applications that decompress attacker-controlled Brotli data may be vulnerable to crashes, memory disclosure or corruption, and remote code execution.
Node.js, .NET, Python and other projects have released fixes, and maintainers advise updating affected software and restarting services.
Researchers disagree on whether the flaw has been exploited in real-world attacks: ELLIO reported seeing exploit traffic, while other reports said no active exploitation had been observed.
The flaw was fixed in Brotli source code in February 2026, but the fix was not released to users until October.
- Who
- Users and organizations running software with vulnerable Brotli decoders may be affected. Attackers could exploit systems that process malicious Brotli data.
- What
- CVE-2026-111497 is a buffer overflow in the Brotli decompression library. It can cause crashes, memory exposure or corruption, and potentially remote code execution.
- When
- Node.js publicly disclosed the flaw on October 21, 2026. Fixes for Brotli versions were made available in October.
- Where
- The flaw affects software and services that use vulnerable Brotli decoders, including products across Node.js, .NET, Python and other ecosystems.
- Why
- A specially crafted Brotli-compressed stream can make the decoder write beyond an internal buffer when processing attacker-controlled data.
ELLIO
Researchers reporting no observed active exploitation
Exploitation in the wild
ELLIO
ELLIO said its sensors recorded exploit traffic carrying a public exploit that it had confirmed could get a shell on vulnerable builds.
Researchers reporting no observed active exploitation
CyberScoop said researchers had not observed active exploitation in real networks, while BleepingComputer and Microsoft’s advisory said there were no reports of malicious exploitation in the wild or successful criminal attacks.
The fix for CVE-2026-111497 was committed to the Brotli source code.
Node.js publicly disclosed the vulnerability and released fixes.
Python packages containing fixes became available.
Microsoft announced an out-of-band security update for .NET.
ELLIO reported seeing exploit traffic in the wild.
- Vulnerability
- CVE-2026-111497
- Brotli fixed versions
- 1.0.10, 1.1.1 and 1.2.1
- Node.js fixed versions
- 22.23.4, 24.22.1 and 26.12.1
- Affected ecosystems
- Node.js, .NET, Python, Bun, Envoy, Istio, FFmpeg and Apache Arrow
- Wiz cloud estimate
- 91% of cloud environments have resources vulnerable to the flaw
- Publicly exposed Node.js estimate
- 82% of cloud environments have publicly exposed Node.js instances
13 sources
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Angreifer nehmen Brotli-, Adobe-Commerce- und Magento-Lecks ins Visier
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
Brotli bug reaches far beyond Node.js (CVE-2026-111497)
Experts temper emergency-level alarms over critical Brotli defect
Microsoft releases emergency .NET security fixes for Google Brotli bug
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
Node2Shell flaw embedded in apps and dev tools far beyond Node.js
What people are saying
An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution
have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds.
The attack surface is “extremely broad and vast, but much of the impact of exploitation depends entirely on its implementation and how it is used within that piece of software,
What’s changed now is that AI is pumping out complex — and often not clearly explained — finds at a much higher rate, exponentially increasing noise levels and making it much more difficult both to debunk overhyped vulnerability discoveries and to determine which vulnerabilities are broadly exploitable in real-world production configurations.
Posts on X
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their