CVE-2026-111497 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-22

Added to CISA KEV: 2026-10-27 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE (within 24h): Update Node.js, Bun, and .NET runtimes to versions bundling patched Brotli (≥1.0.10, ≥1.1.1, or ≥1.2.1). Do not assume application-level updates are sufficient — the runtime itself must be updated.
IMMEDIATE: Audit all direct Brotli library dependencies across your software supply chain (Google Brotli C/C++, andybalholm/brotli for Go, Python brotli/brotlicffi). Upgrade to patched versions.
IMMEDIATE: For NGINX or other reverse proxies using system-linked libbrotli, update the underlying OS package (apt/yum upgrade libbrotli) — application container updates may not address dynamically linked system libraries.
SHORT-TERM (within 48–72h if patching is delayed): Implement WAF rules to inspect or block HTTP requests with 'Content-Encoding: br' headers at the edge. This is a temporary mitigation that may impact legitimate traffic.
SHORT-TERM: Consider disabling Brotli decompression at the CDN/load balancer layer and forcing re-encoding to gzip for requests reaching origin servers, as a temporary risk reduction measure.
MONITORING: Review server logs for anomalous process crashes, memory errors, or unexpected process restarts in HTTP worker processes — these may indicate exploitation attempts triggering the DoS path.
MONITORING: Monitor for unexpected child process spawning or outbound connections from web server processes, which could indicate successful RCE exploitation.
MONITORING: Deploy network detection rules to identify malformed Brotli-compressed payloads in HTTP traffic (reference signatures being published by the security community following broccoli2shell.com disclosure).
PATCH PRIORITY: CRITICAL — treat as P0. PoC is publicly available, the vulnerability is pre-auth, no user interaction is required, and the impact includes RCE. Patch or mitigate before end of business day.

🔍 Web Intelligence (Kagi · 2026-10-27)

Summary

CVE-2026-111497, also known as "Node2Shell" or "HTTP2Shell," is a critical buffer overflow vulnerability specifically characterized as an out-of-bounds heap write in the Google Brotli compression library (versions 1.0.3 through 1.2.0). Because Brotli is a widely used compression algorithm integrated into core runtimes and frameworks like Node.js, Bun, and various language-specific bindings, this flaw allows a remote, unauthenticated attacker to supply malformed Brotli-compressed data to trigger memory corruption. It is highly significant due to its potential to achieve remote code execution (RCE) on a vast array of internet-facing services that automatically decompress user-provided traffic.

Exploitation

Active Exploitation: There are reports of active research and development of weaponized exploit code, including efforts to convert initial denial-of-service triggers into full remote code execution in common environments like Express.js.
Threat Actors: While no specific state-sponsored campaigns have been definitively linked at this time, the severity of the flaw has triggered immediate attention from security researchers and threat analysis teams globally.
PoC Availability: Publicly available proof-of-concept code and analysis repositories exist on platforms like GitHub, which detail the process of manipulating the heap via crafted Brotli streams.
Attack Prerequisites: The attack is network-based and does not require authentication or user interaction; an attacker only needs to send a malicious, Brotli-compressed payload to an application that processes that data.

Affected Products & Patches

Affected Versions: Google Brotli library versions 1.0.3 through 1.2.0; the flaw also impacts environments that bundle these versions, including various releases of Node.js, Bun, and Python Brotli/brotlicffi packages.
Patch Availability: Users should update their runtimes and applications to the latest versions, which include patched versions of the underlying Brotli dependency.
Mitigations/Workarounds: Organizations should audit applications for Brotli usage; if an immediate update is not possible, implementing WAF rules to inspect or block Brotli-encoded content or disabling Brotli compression at the edge may serve as temporary risk-reduction measures. Note that some systems, such as certain NGINX configurations, may rely on dynamic linking and should have their underlying system libraries updated to ensure the vulnerability is addressed.

Impact

Access/Capability: Successful exploitation allows for the corruption of decoder state memory, which can lead to three primary outcomes: arbitrary code execution on the target server, disclosure of sensitive memory contents, or a complete denial-of-service (DoS) via process crashes.
Business Risk: For internet-facing deployments, the risk is extreme, as the vulnerability affects the entry point of data processing pipelines (such as web servers and API gateways). A successful attack could lead to full system compromise, data breaches, and extended service outages.