Research

Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.

Read at Datadog Security Labs

Vendor

Node.js

Product

Node.js

EPSS

0.83 (p100)

Exposure class

Developer platform

• Datadog Security Labs (securitylabs.datadoghq.com)
• CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 26
   Ubuntu notice Ubuntu 2d ago

   .NET vulnerabilities

   CVE-2026-102870CVE-2026-111497CVE-2026-114148 Canonical
2. 48
   AWS bulletin AWS 3d ago

   CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

   EPSS 0.83 CVE-2026-111497 Amazon Web Services
3. 38
   Research ThreatLabz 3d ago

   CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

   EPSS 0.83 CVE-2026-111497 Google Node.js
4. 39
   CCCS advisory CCCS 3d ago

   AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497

   EPSS 0.83 CVE-2026-111497 Google
5. 36
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   EPSS 0.83 No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js
6. 58
   Research Sophos X-Ops 4d ago

   Node2Shell (CVE-2026-111497) in active exploitation

   Exploited EPSS 0.83 CVE-2026-111497
7. 53
   Cisco advisory Cisco PSIRT 4d ago

   Vulnerabilities in Node.js Affecting Cisco Products: October 2026

   EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+1 more Cisco Node.js
8. 69
   CISA alert CISA 4d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 0.83 CVE-2026-48356CVE-2026-111497 Google Adobe
9. 42
   Outbreak alert FortiGuard 5d ago

   Node2Shell Remote Code Execution

   EPSS 0.83 CVE-2026-111497 Google Node.js
10. 41
    Tenable research Tenable 5d ago

    Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

    EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
11. 56
    News CyberScoop 5d ago

    Experts temper emergency-level alarms over critical Brotli defect

    Exploited EPSS 0.83 CVE-2026-111497
12. 55
    Threat signal FortiGuard 5d ago

    Node.js Brotli Remote Code Execution (Node2Shell)

    PoC public EPSS 0.83 Fix available CVE-2026-111497 Google Node.js
13. 37
    Palo Alto advisory Palo Alto PSIRT 5d ago

    Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 0.83 CVE-2026-111497 Palo Alto Networks
14. 31
    News The Register 5d ago

    Microsoft releases emergency .NET security fixes for Google Brotli bug

    EPSS 0.83 CVE-2026-111497 Microsoft Google
15. 81
    Research Rapid7 5d ago

    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

    Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js
16. 39
    CCCS advisory CCCS 5d ago

    Google security advisory (AV26-1085)

    EPSS 0.83 CVE-2026-111497 Google
17. 66
    Advisory Fortinet PSIRT 6d ago

    Node2Shell CVEs

    CVSS 9.8 EPSS 0.83 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
18. 31
    Wiz Research Wiz 6d ago

    Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

    EPSS 0.83 CVE-2026-111497
19. 37
    Advisory MSRC 6d ago

    Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

    EPSS 0.83 CVE-2026-111497 Microsoft Google
20. 39
    Qualys TRU Qualys 8d ago

    Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

    EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js