2026-10-27
Brotli vulnerability CVE-2026-111497 (Node2Shell): how to check Node.js, Python and .NET, and what to update
On October 21, 2026 (US time), Google published Brotli 1.2.1, 1.1.1 and 1.0.10 to fix CVE-2026-111497, an out-of-bounds write in the official Brotli library. Brotli 1.0.3–1.0.9, 1.1.0 and 1.2.0 are affected. Decompressing crafted Brotli data can corrupt memory and lead to crashes, memory disclosure or, potentially, arbitrary code execution. Google rates it 9.2 under CVSS v4.0. Node.js released 22.23.4, 24.22.1 and 26.12.1 the same day, and on October 22 the PyPI packages were fixed in brotli 1.2.1 and brotlicffi 1.2.1.0. Microsoft published fixes for .NET 8, 9 and 10 (8.0.33, 9.0.22, 10.0.14) on October 25 (US time), and Bun (1.4.4) and Envoy also shipped fixes. JPCERT/CC, Japan's computer emergency response team, issued an alert on October 26 that mentions the nicknames Node2Shell and HTTP2Shell. Many programs carry their own copy of Brotli, so updating the operating system's library does not fix the copies inside official Node.js builds, Python wheels from PyPI, container images or single-file executables. As of the morning of October 27 (Japan time), CISA's Known Exploited Vulnerabilities (KEV) catalog does not list it, and no primary source reports exploitation. This site's conclusion: if a Node.js, Bun, Python or .NET service decompresses data it receives from outside, check versions today, update, then rebuild containers and executables.