Node.js Brotli Remote Code Execution (Node2Shell)
What is the Vulnerability? CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web communications and is bundled with Node.js through its `zlib` module. Brotli is an open-source project developed and maintained by Google for lossless data compression. It shrinks files so they can be transmitted faster without affecting the original data. The vulnerability occurs when the decoder processes specially crafted Brotli-compressed input. An attacker who can supply malicious compressed data to a vulnerable application may corrupt adjacent memory, potentially l
Read at FortiGuard Threat Signal reports
- Vendor
- Google, Node.js
- Product
- ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js
- EPSS
- 0.83 (p100)
- Exploitation
- public exploit code reported
- Fix
- available
- Exposure class
- Developer platform
Why it ranks 55 (High)
- Public exploit code reported
- EPSS 0.55 (high probability of exploitation)
- Product class: developer platform
- Covered by 16 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- FortiGuard Threat Signal reports (fortiguard.fortinet.com)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.