Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CRITICAL · VULNERABILITYCVE-2026-111497redteam/daily · 5 sources
- Severity
- Critical
- Highest CVSS
- 9.2
- Exploited
- Yes
- Sources
- 5
What happened
CVE-2026-111497 is a CWE-787 out-of-bounds write in the Brotli decoder, exploitable remotely without authentication via crafted compressed data. Affected versions are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1; fixed releases are 1.0.10, 1.1.1 and 1.2.1. CISA added it to KEV on 27 October 2026. The Cyber Centre advises identifying internet-facing systems and third-party software that bundle Brotli, patching promptly, blocking Brotli content from untrusted sources where patching is not possible, and monitoring for crashes or abnormal process behaviour. AWS reports several services are addressing the issue, some requiring customer action, and Fortinet lists the flaw as affecting Node.js 26.x, 24.x and 22.x.
For security analysts · Written by AI from 5 sources · Wrong?
What to do
- Update Microsoft .net to the fixed version for your release line (fixes CVE-2026-111497): 8.0.33, 9.0.22 or 10.0.14.
- Update Google Brotli to the fixed version for your release line (fixes CVE-2026-111497): 1.0.10, 1.1.1 or 1.2.1.
- CISA lists CVE-2026-111497 as exploited and gives US federal agencies until 10 November 2026 to act (7 days left).
- Check whether you use Microsoft .net: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-111497CVSS 9.2ExploitedA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execu
- CVE-2026-105482CVSS 7.4A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a
- CVE-2026-105483CVSS 7.4A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as
- CVE-2026-106069CVSS 7.4A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host fo
- CVE-2026-106072CVSS 6.7A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as
- CVE-2026-105481CVSS 6.5A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loo
- CVE-2026-106074CVSS 4.8A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or
- CVE-2026-106070CVSS 3.7A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compa
- CVE-2026-106071CVSS 3.6A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a
- CVE-2026-106073CVSS 3.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-re
Full story timeline · 17 updates
- Thu 22 OctoberCVE-2026-111497 published, CVSS 9.2NVD
- Fri 23 OctoberCVE-2026-105481 published, CVSS 6.5NVD
- CVE-2026-105482 published, CVSS 7.4NVD
- CVE-2026-105483 published, CVSS 7.4NVD
- CVE-2026-106069 published, CVSS 7.4NVD
- CVE-2026-106070 published, CVSS 3.7NVD
- CVE-2026-106071 published, CVSS 3.6NVD
- CVE-2026-106072 published, CVSS 6.7NVD
- CVE-2026-106073 published, CVSS 3.3NVD
- CVE-2026-106074 published, CVSS 4.8NVD
- Mon 26 OctoberNode2Shell CVEsFortinet PSIRT Advisories
- Tue 27 OctoberCVE-2026-111497 added to CISA’s exploited listCISA KEV
- Node2Shell puts Microsoft and Node.js on Brotli patch dutyCSO Online
- Google security advisory (AV26-1085) - Update 1Canadian Centre for Cyber Security
- Wed 28 OctoberAL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497Canadian Centre for Cyber Security
- CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory DisclosureAWS Security Bulletins
- Thu 29 OctoberCVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks Security Advisories
Who reported · 5 outlets
Fortinet PSIRT AdvisoriesCSO OnlineCanadian Centre for Cyber SecurityAWS Security BulletinsPalo Alto Networks Security Advisories