Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. Change log Update October 28: Added a section on how reliable exploitation of CVE-2026-111497 has been so far, based on research from ELLIO and Imperva. Click here to review the change log history Update October 28: Added a section on how reliable exploitation of CVE-2026-111497 has been so far, based on research from ELLIO and Imperva. Update October 27: CISA added CVE-2026-111497 to its
- Vendor
- Google, Node.js
- Product
- Istio / Envoy, Node.js
- EPSS
- 1.00 (p100)
- Fix
- available
- Exposure class
- Developer platform
Why it ranks 41 (Notable)
- EPSS 0.88 (high probability of exploitation)
- Product class: developer platform
- Covered by 37 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Tenable Research (tenable.com)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.