CVE record · 21 sources
CVE-2026-111497
KEV · due 10 Nov 2026CVSS 9.8Google Brotli Unchecked Return Value Vulnerability
- Vendor
- Product
- Brotli
- CVSS v3.0
- 9.8
- EPSS
- 0.83 (p100)
- CISA KEV
- added 27 Oct 2026, due 10 Nov 2026 (9d)
- Weakness
- CWE-252, CWE-787
- Exposure class
- Developer platform, Web platform, Network management, Cloud platform
Coverage
23Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially…
-
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x…
-
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure. Change log Update October 28…
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type…
-
Node2Shell CVEs
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…
-
Node2Shell (CVE-2026-111497) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Node2Shell, Brotli
-
Experts temper emergency-level alarms over critical Brotli defect
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild. The post Experts temper emergency-level alarms over critical Brotli defect appeared first…
-
Node.js Brotli Remote Code Execution (Node2Shell)
What is the Vulnerability? CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web…
-
Vulnerabilities in Node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli…
-
CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to run code or read process…
-
Node2Shell Remote Code Execution
CVE-2026-111497 is an out-of-bounds write vulnerability in Google's Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web communications and is…
-
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes…
-
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…
-
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
-
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and…
-
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
Information published.
-
Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…
-
Microsoft releases emergency .NET security fixes for Google Brotli bug
Redmond joins growing list of software maintainers scrambling to patch compression flaw
-
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
-
.NET vulnerabilities
It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via…