Vulnerability · CVE-2026-111497

Out-of-Bounds Write in Google Brotli Decoder

Published Oct 22, 2026 · catalog updated Oct 24, 2026 · Cloudflare Red Hat Enterprise Linux

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check this week

CVE-2026-111497 is not in CISA KEV. FIRST estimates a 32.78% chance of exploitation in the next 30 days. Check whether you run Cloudflare Red Hat Enterprise Linux.

Gaps on this record

No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software · Press · The Hacker News
Node2Shell : la faille Brotli qui expose Node.js à une exécution de code à distance · Press · IT-Connect
Critical Memory-Corruption Vulnerability in Brotli Decoder Affects Multiple Software Platforms · Cyber · The Hacker News
Critical RCE Vulnerability Discovered in Node.js via Brotli Decoder · Cyber · The Hacker News

Severity: Critical9.2
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 32.78%
Remediation: Advisory link
Affected products: Bitnami node · Bitnami node-min · Debian:12 brotli · Debian:12 nodejs · Debian:13 brotli · Debian:13 nodejs

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write (CWE-787) in Google's Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous value for an invalid block switch, and the fast decode path discards it (CWE-252, unchecked return value), so a crafted Brotli stream makes the decoder continue on corrupted state and write past the ring buffer. Upstream rates it CVSS 4.0 9.2 and classifies the impact as potential remote code execution. The vulnerability is in Google's C library, not in Node.js specifically. The PyPI package is Google's CPython binding and compiles the same c/dec/decode.c that has the original vulnerability. All releases up to and including 1.2.0 ship the vulnerable decoder; 1.2.1 contains the upstream fix (commit 0ed4268a) and differs from 1.2.0 only in that fix plus a version bump. The decoder is reached whenever untrusted Brotli data is decompressed. With installed, common HTTP clients decode Brotli responses automatically (urllib3/requests, httpx with the brotli extra, aiohttp) and services that accept request bodies decode inbound data, so the flaw is reachable from attacker-controlled input.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Bitnami node0 → 22.23.4
Bitnami node-min0 → 22.23.4
Debian:12 brotli0 → 1.0.9-2+deb12u1
Debian:12 brotli1.0.9-2, 1.1.0-1, 1.1.0-2
Debian:12 nodejs18.13.0+dfsg1-1, 18.13.0+dfsg1-1.1, 18.19.0+dfsg-1
Debian:13 brotli0 → 1.1.0-2+deb13u1
Debian:13 brotli1.1.0-2, 1.2.0-1, 1.2.0-2
Debian:13 nodejs20.19.2+dfsg-1, 20.19.2+dfsg-1+deb13u1, 20.19.2+dfsg-1+deb13u2
Debian:14 brotli1.1.0-2, 1.2.0-1, 1.2.0-2
Debian:14 nodejs20.19.2+dfsg-1, 20.19.4+dfsg-1, 20.19.5+dfsg+~cs20.19.12-1
PyPI brotli0 → 1.2.1
PyPI brotli1.0.3 → 1.2.1
PyPI brotlicffi0 → 1.2.1.0
PyPI brotlicffi1.0.3 → 1.2.1.0
redhat brotli-main-1.2.1-0.1.hum1version unspecified
vendor Googleversion unspecified
vendor Google Brotliversion unspecified

How to fix CVE-2026-111497

Upgrade
CVE-2026-111497 lists a fix boundary at 22.23.4. Compare the installed build with that boundary before you change production.
Version check
Fixed in 22.23.4 · 9 other ranges on the advisory
Advisory
Open the cloudflare_waf record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-111497 is not in CISA KEV. FIRST estimates a 32.78% chance of exploitation in the next 30 days. Check whether you run Cloudflare Red Hat Enterprise Linux.

Which versions are affected?

Compare what you have installed with 0 → 22.23.4, 0 → 1.0.9-2+deb12u1, 1.0.9-2, 1.1.0-1, 1.1.0-2, 18.13.0+dfsg1-1, 18.13.0+dfsg1-1.1, 18.19.0+dfsg-1, 0 → 1.1.0-2+deb13u1, 1.1.0-2, 1.2.0-1, 1.2.0-2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-252: Unchecked Return Value; CWE-787: Out-of-bounds Write. EPSS 32.78%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Repository · github.com

Related records

Linked stories and findings that share CVE identifiers or explicit correlation edges.

Threat intelligence · discusses
Critical RCE Vulnerability Discovered in Node.js via Brotli Decoder
Threat intelligence · discusses
Critical Memory-Corruption Vulnerability in Brotli Decoder Affects Multiple Software Platforms

Timeline

Detection, updates, and resolution for this record.

Oct 22, 2026 · OpenSSF OSV / OSV Scanner
Detected
Oct 22, 2026 · OpenSSF OSV / OSV Scanner
Updated
The description or metadata changed.
Oct 22, 2026 · OpenSSF OSV / OSV Scanner
Updated
The description or metadata changed.
Oct 22, 2026 · CVE.org
Updated
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
Oct 22, 2026 · NIST NVD
Updated
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotlicffi fixed in 1.2.1.0
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotli fixed in 1.2.1
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotli fixed in 1.2.1
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotlicffi fixed in 1.2.1.0
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Updated
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write (CWE-787) in Google's Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns an ambiguous value for an invalid block switch, and the fast decode path discards it (CWE-252, unchecked return value), so a crafted Brotli stream makes the decoder continue on corrupted state and write past the ring buffer. Upstream rates it CVSS 4.0 9
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
node fixed in 22.23.4
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
node fixed in 22.23.4
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
node-min fixed in 22.23.4
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
node-min fixed in 22.23.4
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Updated
A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.
Oct 23, 2026 · EUVD
Updated
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotli fixed in 1.0.9-2+deb12u1; brotli fixed in 1.1.0-2+deb13u1
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotli fixed in 1.0.9-2+deb12u1
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Fix available
brotli fixed in 1.1.0-2+deb13u1
Oct 23, 2026 · OpenSSF OSV / OSV Scanner
Updated
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
Oct 24, 2026 · GitHub Advisory Database
Fix available
brotli fixed in 1.2.1; brotlicffi fixed in 1.2.1.0
Oct 24, 2026 · GitHub Advisory Database
Updated
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie

Sources

Cloudflare WAF rulesVendor advisoryCVE-2026-111497
CVE-2026-111497 is named in an emergency Cloudflare managed-rules release. The default action recorded for those rules is Log.
developers.cloudflare.com
CVE.orgVulnerability recordCVE-2026-111497
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,
cve.org
FIRST EPSSExploitation probabilityCVE-2026-111497
30-day exploitation probability 32.78%
first.org
EUVDVulnerability recordEUVD-2026-108169
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,
euvd.enisa.europa.eu
GitHub Advisory DatabasePackage advisoryGHSA-9v8h-qqgm-4m35
GitHub Advisory Database record mirrored by OSV.
github.com
NIST NVDVulnerability recordCVE-2026-111497
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,
nvd.nist.gov
Openwall OSS SecurityThreat researchCVE-2026-111497
Research mention from Openwall OSS Security. Not confirmation of exploitation.
openwall.com
OpenSSF OSV / OSV ScannerPackage advisoryBIT-node-2026-111497
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryBIT-node-min-2026-111497
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-111497
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryGHSA-9v8h-qqgm-4m35
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryPYSEC-2026-4322
Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryPYSEC-2026-4323
Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package
osv.dev
PyPA Advisory DatabasePackage advisoryPYSEC-2026-4322
Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
osv.dev
PyPA Advisory DatabasePackage advisoryPYSEC-2026-4323
Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package
osv.dev
Red Hat Security DataVendor advisoryCVE-2026-111497
brotli: Out-of-Bounds Write in Google Brotli Decoder
access.redhat.com
Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-111497
osv.dev

References

Freshness

Last verified in this catalog Oct 25, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

GitHub Advisory DatabaseOct 25, 2026
OpenSSF OSV / OSV ScannerOct 25, 2026
OpenSSF OSV / OSV ScannerOct 25, 2026
OpenSSF OSV / OSV ScannerOct 25, 2026
OpenSSF OSV / OSV ScannerOct 25, 2026
OpenSSF OSV / OSV ScannerOct 25, 2026
FIRST EPSSOct 25, 2026
Cloudflare WAF rulesOct 25, 2026
Openwall OSS SecurityOct 25, 2026
OpenSSF OSV / OSV ScannerOct 24, 2026
EUVDOct 23, 2026
PyPA Advisory DatabaseOct 23, 2026
PyPA Advisory DatabaseOct 23, 2026
Red Hat Security DataOct 23, 2026
NIST NVDOct 22, 2026
CVE.orgOct 22, 2026
Trivy Vulnerability DBOct 22, 2026

Priority score

42/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability7/20
CVSS severity14/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Detection5/5
Threat research5/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.2 v4.0
Technical impact. Separate from exploitation likelihood.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS probability
32.78% · p98.34%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Advisory link
A patch or advisory reference is linked. Open the original publisher for availability by product version.

Stacks

Debian Debian 12 Debian 13 Debian 14 Google Linux Node.js PyPI Red Hat

Weakness

CWE-252
Unchecked Return Value
MITRE definition
CWE-787
Out-of-bounds Write
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.