Research

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.

Read at Wiz Research

EPSS

0.83 (p100)

• Wiz Research (wiz.io)
• CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 26
   Ubuntu notice Ubuntu 2d ago

   .NET vulnerabilities

   CVE-2026-102870CVE-2026-111497CVE-2026-114148 Canonical
2. 38
   Research Datadog Security Labs 3d ago

   Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

   EPSS 0.83 CVE-2026-111497 Node.js
3. 48
   AWS bulletin AWS 3d ago

   CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

   EPSS 0.83 CVE-2026-111497 Amazon Web Services
4. 38
   Research ThreatLabz 3d ago

   CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

   EPSS 0.83 CVE-2026-111497 Google Node.js
5. 39
   CCCS advisory CCCS 3d ago

   AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497

   EPSS 0.83 CVE-2026-111497 Google
6. 36
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   EPSS 0.83 No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js
7. 58
   Research Sophos X-Ops 4d ago

   Node2Shell (CVE-2026-111497) in active exploitation

   Exploited EPSS 0.83 CVE-2026-111497
8. 53
   Cisco advisory Cisco PSIRT 4d ago

   Vulnerabilities in Node.js Affecting Cisco Products: October 2026

   EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+1 more Cisco Node.js
9. 69
   CISA alert CISA 4d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 0.83 CVE-2026-48356CVE-2026-111497 Google Adobe
10. 42
    Outbreak alert FortiGuard 5d ago

    Node2Shell Remote Code Execution

    EPSS 0.83 CVE-2026-111497 Google Node.js
11. 41
    Tenable research Tenable 5d ago

    Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

    EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
12. 56
    News CyberScoop 5d ago

    Experts temper emergency-level alarms over critical Brotli defect

    Exploited EPSS 0.83 CVE-2026-111497
13. 55
    Threat signal FortiGuard 5d ago

    Node.js Brotli Remote Code Execution (Node2Shell)

    PoC public EPSS 0.83 Fix available CVE-2026-111497 Google Node.js
14. 37
    Palo Alto advisory Palo Alto PSIRT 5d ago

    Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 0.83 CVE-2026-111497 Palo Alto Networks
15. 31
    News The Register 5d ago

    Microsoft releases emergency .NET security fixes for Google Brotli bug

    EPSS 0.83 CVE-2026-111497 Microsoft Google
16. 81
    Research Rapid7 5d ago

    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

    Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js
17. 39
    CCCS advisory CCCS 5d ago

    Google security advisory (AV26-1085)

    EPSS 0.83 CVE-2026-111497 Google
18. 66
    Advisory Fortinet PSIRT 6d ago

    Node2Shell CVEs

    CVSS 9.8 EPSS 0.83 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
19. 37
    Advisory MSRC 6d ago

    Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

    EPSS 0.83 CVE-2026-111497 Microsoft Google
20. 39
    Qualys TRU Qualys 8d ago

    Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

    EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js