CVE-2026-111497criticalobserved exploitationCWE-252CWE-787

CVE-2026-111497: critical vulnerability in Google Brotli

Out-of-Bounds Write in Google Brotli Decoder

Published · Updated

Follow this CVE+ Monitor Brotli+ Monitor nodejs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

94Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 9.2epss 83%
from disclosure to weaponsame day
Published on NVDOct 22
1st PoCOct 21
VulnCheck+4d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 102/2026 · 28 Oct 2026Vulnerabilidade crítica no Brotli - Googleread on gov.br ↗
  • CISC Gov.br · 27 Oct 2026Boletim do CISC de Vulnerabilidadesread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-11-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Google · Brotli
public PoCs found — 123
githubgithub.com/assetnote/node2shell-scanner★ 86githubgithub.com/dimasma0305/CVE-2026-111497-POC★ 77githubgithub.com/trailofbits/brotli-checker★ 68githubgithub.com/syrex1013/CVE-2026-111497-node2shell★ 52githubgithub.com/caveeroo/cve-2026-111497-wordpress-poc★ 31githubgithub.com/CaterMaoZi/CVE-2026-111497-POC★ 17githubgithub.com/ZeroHackOrg/node2shell-poc★ 8githubgithub.com/hypnguyen1209/CVE-2026-111497★ 7githubgithub.com/ikow/brotli2crash★ 6githubgithub.com/GlobularOne/HTTP2Shell-PoC★ 4githubgithub.com/tc4dy/CVE-2026-111497-Toolkit★ 4githubgithub.com/fortbridge/cve-2026-111497-wordpress-pingback-brotli★ 3githubgithub.com/shivrajem/node2shell-detect★ 3githubgithub.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn★ 3githubgithub.com/CompleteTech-Security/http2shell-check★ 2githubgithub.com/CompleTetech-Security/node2shell-check★ 2githubgithub.com/googlesky/CVE-2026-111497★ 2githubgithub.com/Arkango/CVE-2026-111497★ 2githubgithub.com/Hika-sec/http2shell-CVE-2026-111497★ 2githubgithub.com/tani2shell/node2shell-lab★ 2githubgithub.com/CompleTech-Security/node2shell-check★ 2githubgithub.com/Secragon/node2shell-radar★ 2githubgithub.com/CompleTech-Security/http2shell-check★ 2githubgithub.com/CompleteTech-Security/node2shell-check★ 2githubgithub.com/yavuzsemih/brotli-secfix★ 1githubgithub.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup★ 1githubgithub.com/FranklinF25/http2shell★ 1githubgithub.com/ionsec/node2shell-detector★ 1githubgithub.com/Sami-AlEsh/nodejs-security-check★ 1githubgithub.com/fieldse/http2shell-checker★ 1githubgithub.com/Ghost-Bx1/DotNet-HTTP2Shell-CVE-2026-111497★ 1githubgithub.com/dansaurabh/brotli2shell_Hunter★ 1githubgithub.com/0xBlackash/CVE-2026-111497★ 1githubgithub.com/fbuff-tools/http2shell-checker★ 1githubgithub.com/Charlie-Netdevops/node-hostcheck★ 1githubgithub.com/pt-act/node2shell-cve-2026-111497★ 1githubgithub.com/tal7aouy/node2shell-scanner★ 1githubgithub.com/CompleTetech-Security/http2shell-check★ 1githubgithub.com/AdapptOnAzure/cve-2026-111497-mitigation★ 1githubgithub.com/SYM01/cve-2026-111497★ 1githubgithub.com/0xredash/CVE-2026-111497★ 1githubgithub.com/Ghost-Bx1/Node2Shell-CVE-2026-111497★ 1githubgithub.com/mehmet-emir-eroglu/NODE2SHELL★ 1githubgithub.com/Sumit0x00/node2shell★ 1githubgithub.com/atiilla/CVE-2026-111497-Node2Shell★ 1githubgithub.com/Nyamort/brotli-pingback-lab★ 1githubgithub.com/depuschm/brotli-k8s-scan★ 1githubgithub.com/EQSTLab/CVE-2026-111497★ 1githubgithub.com/fieldse/brotli-node2shell-check★ 1githubgithub.com/timosar/woff2shell★ 0githubgithub.com/miracle438/node2shell-two-stage★ 0githubgithub.com/adachis/pillow-patched-brotli★ 0githubgithub.com/Sable-Research/brotli-decoder-overflow★ 0githubgithub.com/ChriSec7/CVE-2026-111497-POC★ 0githubgithub.com/Certbn/Brotli-Node.js-CVE-2026-111497-Broccoli2Shell-Node2Shell-HTTP2Shell-★ 0githubgithub.com/MelissaSkywalkz/broccoli2shell-gis★ 0githubgithub.com/sam00/Node2Shell-CVE-2026-111497-POC★ 0githubgithub.com/aymenkmar/node2shell-check★ 0githubgithub.com/CompleteTech-LLC/node2shell-check★ 0githubgithub.com/ks-labs/brotli-patch★ 0githubgithub.com/duytien241/nodejs-CVE-2026-111497★ 0githubgithub.com/queso/formbricks-patched★ 0githubgithub.com/axisops/CVE-2026-111497★ 0githubgithub.com/paulmann/CVE-2026-111497★ 0githubgithub.com/akaihigurashi/brotli2scan★ 0githubgithub.com/avatarnewyork/brotli-check★ 0githubgithub.com/gik2927/CVE-2026-111497-DOS-★ 0githubgithub.com/incu-tech/october-cyber-family★ 0githubgithub.com/datmt/emudhra-fix★ 0githubgithub.com/AmanSin001/node-brotli-check★ 0githubgithub.com/fuzheado/n2s-buildpack-probe★ 0githubgithub.com/Blackman99/lotstamp★ 0githubgithub.com/utkarsssh17/cve-2026-111497-brotli-poc★ 0githubgithub.com/s1ko/poc-cve-2026-111497★ 0githubgithub.com/mnk-works/cve-2026-111497-rce-checker★ 0githubgithub.com/datmt/vulcheck★ 0githubgithub.com/TahuCryptsi/brotli-distro-check★ 0githubgithub.com/apaonum/brotli-cve-check★ 0githubgithub.com/emirwtz/CVE-2026-111497★ 0githubgithub.com/mahumadad/CVE-2026-111497-assessment★ 0githubgithub.com/AdapptOnAzure/CVE-2026-111497-DotNetBrotliScan★ 0githubgithub.com/suominen/CVE-2026-111497★ 0githubgithub.com/Nucklear/CVE-2026-111497-working★ 0githubgithub.com/hayupisama/quarkus-brotli-audit★ 0githubgithub.com/lesterlam/node2shell★ 0githubgithub.com/bastet-ai/brotli-firing-range★ 0githubgithub.com/lushinshang/cve-2026-111497-http2shell-guide★ 0githubgithub.com/piecar21/CVE-2026-111497★ 0githubgithub.com/thebarel/CVE-2026-111497★ 0githubgithub.com/jeffschafer/Bigfix-NodeJS-Vulnerability-Scanner-Content-CVE-2026-111497★ 0githubgithub.com/amier-ge/node2shell-checker★ 0githubgithub.com/tikarammardi/CVE-2026-111497★ 0githubgithub.com/amier-ge/Node2Shell★ 0githubgithub.com/hkoeck/node2shell-status★ 0githubgithub.com/Quaerendir/node2shell-audit★ 0githubgithub.com/foxcornlab/node2shell-inventory-scanner★ 0githubgithub.com/TahuCryptsi/node-brotli-check★ 0githubgithub.com/mehmet-emir-eroglu/CVE-2026-111497★ 0githubgithub.com/sakai-sktech/brotli-check★ 0githubgithub.com/RedSideSecurity/node2shell★ 0vulncheckvulncheck.com/xdb/e92245af32baunverifiedvulncheckvulncheck.com/xdb/f1a058824b30unverifiedvulncheckvulncheck.com/xdb/c2369915a572unverifiedvulncheckvulncheck.com/xdb/a32978d5e9c6unverifiedvulncheckvulncheck.com/xdb/749a90cc9ccdunverifiedvulncheckvulncheck.com/xdb/99735b8dd142unverifiedvulncheckvulncheck.com/xdb/5477a5750a52unverifiedvulncheckvulncheck.com/xdb/5dd299a1e34eunverifiedvulncheckvulncheck.com/xdb/b9a40aa6515cunverifiedvulncheckvulncheck.com/xdb/90f51af75865unverifiedvulncheckvulncheck.com/xdb/c5e251796b95unverifiedvulncheckvulncheck.com/xdb/e815eab86db5unverifiedvulncheckvulncheck.com/xdb/887c72771b58unverifiedvulncheckvulncheck.com/xdb/44200cae0fdfunverifiedvulncheckvulncheck.com/xdb/edcf570219f2unverifiedvulncheckvulncheck.com/xdb/963da2252eebunverifiedvulncheckvulncheck.com/xdb/b4edc5da03c0unverifiedvulncheckvulncheck.com/xdb/023b9597b568unverifiedvulncheckvulncheck.com/xdb/5fe47e0d73beunverifiedvulncheckvulncheck.com/xdb/441e51bdf75cunverifiedvulncheckvulncheck.com/xdb/f0a2c45e431cunverifiedvulncheckvulncheck.com/xdb/e036a897b3c0unverifiedvulncheckvulncheck.com/xdb/93d3d642e1c6unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.