Brotli
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Named in breach reports by Help Net SecurityWeek in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
- Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
Recent news
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
The weekly review headlines a $6.3 billion theft affecting Binance and the impact of a Brotli vulnerability, though the excerpt provides no further detail on either. It also notes that the r/opensource subreddit moderators have barred projects that use, are made by, or are intended for AI.
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.
CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.