An out-of-bounds write vulnerability in Google’s Brotli decoder, tracked as CVE-2026-111497, has prompted security updates from Microsoft, Node.js, and Python package maintainers, and could allow code execution.
The vulnerability or weakness
The vulnerability, dubbed Node2Shell, is an out-of-bounds write in Brotli 1.0.3 through 1.2.0, affecting applications that use the Brotli decoder. It has a CVSS v4 score of 9.2, placing it in the critical category.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-111497 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software (2026-10-24)
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data (2026-10-23)
- Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions (2026-10-22)
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (2026-10-21)
Business impact
Organizations using affected applications could face significant business impacts, including potential data breaches and system crashes, leading to financial losses and operational disruptions.
Industries affected
This issue affects a wide range of industries, including software development, web hosting, and cloud services, as Brotli is widely used for data compression.
Users affected
Users of Node.js, .NET, PowerShell, and Python packages are affected, as these applications may be vulnerable to the attack if they use the Brotli decoder without the latest patches.
