Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CRITICAL · VULNERABILITYCVE-2026-111497redteam/daily · 5 sources
- Severity
- Critical
- Highest CVSS
- 9.2
- Exploited
- Yes
- Sources
- 5
What happened
A serious flaw has been found in Brotli, a widely used tool that shrinks website files. An attacker could send specially crafted data to take over affected software without needing a password. US authorities say it is already being used in attacks, so organisations should update quickly.
Like I’m new · Written by AI from 5 sources · Wrong?
What to do
- Update Microsoft .net to the fixed version for your release line (fixes CVE-2026-111497): 8.0.33, 9.0.22 or 10.0.14.
- Update Google Brotli to the fixed version for your release line (fixes CVE-2026-111497): 1.0.10, 1.1.1 or 1.2.1.
- CISA lists CVE-2026-111497 as exploited and gives US federal agencies until 10 November 2026 to act (7 days left).
- Check whether you use Microsoft .net: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-111497CVSS 9.2ExploitedA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execu
- CVE-2026-105482CVSS 7.4A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a
- CVE-2026-105483CVSS 7.4A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as
- CVE-2026-106069CVSS 7.4A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host fo
- CVE-2026-106072CVSS 6.7A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as
- CVE-2026-105481CVSS 6.5A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loo
- CVE-2026-106074CVSS 4.8A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or
- CVE-2026-106070CVSS 3.7A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compa
- CVE-2026-106071CVSS 3.6A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a
- CVE-2026-106073CVSS 3.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-re
Full story timeline · 17 updates
- Thu 22 OctoberCVE-2026-111497 published, CVSS 9.2NVD
- Fri 23 OctoberCVE-2026-105481 published, CVSS 6.5NVD
- CVE-2026-105482 published, CVSS 7.4NVD
- CVE-2026-105483 published, CVSS 7.4NVD
- CVE-2026-106069 published, CVSS 7.4NVD
- CVE-2026-106070 published, CVSS 3.7NVD
- CVE-2026-106071 published, CVSS 3.6NVD
- CVE-2026-106072 published, CVSS 6.7NVD
- CVE-2026-106073 published, CVSS 3.3NVD
- CVE-2026-106074 published, CVSS 4.8NVD
- Mon 26 OctoberNode2Shell CVEsFortinet PSIRT Advisories
- Tue 27 OctoberCVE-2026-111497 added to CISA’s exploited listCISA KEV
- Node2Shell puts Microsoft and Node.js on Brotli patch dutyCSO Online
- Google security advisory (AV26-1085) - Update 1Canadian Centre for Cyber Security
- Wed 28 OctoberAL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497Canadian Centre for Cyber Security
- CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory DisclosureAWS Security Bulletins
- Thu 29 OctoberCVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks Security Advisories
Who reported · 5 outlets
Fortinet PSIRT AdvisoriesCSO OnlineCanadian Centre for Cyber SecurityAWS Security BulletinsPalo Alto Networks Security Advisories