CriticalPublic exploitVulnerability

CVE-2026-111497

HTTP2Shell (Node2Shell)

Published Oct 22, 2026 · Updated today

Trending this week#3of 415,255 vulnerabilities

Mention activity · 30 days

At least 200 mentions · peak 118 in a dayToday

CVSS9.2Critical · v4

EPSS0.71%53rd percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendors: GoogleNodejsDebian ProjectMicrosoft Corporation

IdentifiersCVE-2026-111497CWE-787 · Out-of-bounds Write

Also known asHTTP2Shellnode2shell

CVE-2026-111497, also known as HTTP2Shell, Node2Shell, and Broccoli2Shell, is an out-of-bounds write vulnerability in Google's reference C Brotli decoder. Affected upstream releases are 1.0.3 through 1.0.9, 1.1.0, and 1.2.0, across all platforms. DecodeBlockTypeAndLength() conflates invalid block switches with insufficient input, while the fast decoding path discards its return value. Malformed compressed input can consequently leave stale decoder state and cause memory corruption. Software incorporating the vulnerable decoder may be exposed through HTTP request decompression, automatically decompressed HTTP responses, or Brotli-compressed file formats. Potential consequences include process crashes, sensitive memory disclosure, and arbitrary code execution. The HTTP2Shell name does not denote an HTTP/2 protocol vulnerability. Exploit reachability and general reliability remain disputed, although code execution has been reported against a stock Node.js Linux arm64 build.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can corrupt adjacent decoder state, terminate the decoding process, disclose sensitive process memory, or potentially execute arbitrary code with the affected process's privileges. Memory disclosure could expose credentials and application secrets; code execution could compromise data and resources accessible to the process. Impact extends beyond Node.js to applications, clients, proxies, and file-processing tools incorporating affected Brotli decoder copies. Reported code execution is configuration-specific and does not establish reliable exploitation across platforms. No confirmed in-the-wild exploitation was reported as of October 24, 2026.

Mitigation

If you can’t patch tonight, do this now.

Until patched, prevent attacker-controlled data from reaching affected decoders. Reject Brotli-encoded request bodies before decompression, disable unnecessary request-body inflation, and remove configured Brotli decompressors from proxies. Disable automatic Brotli response decoding or reject Brotli responses before decompression; removing optional Python Brotli packages can eliminate that decoding path where operationally acceptable. Restrict untrusted fetch destinations and suspend or quarantine ingestion of untrusted Brotli-compressed files. Merely omitting br from Accept-Encoding is insufficient because clients may still decode responses marked with Content-Encoding: br. Inbound WAF filtering does not protect outbound response-decoding paths. Least privilege and process isolation can reduce consequences but do not correct the decoder flaw.

Remediation

Patch, then assume compromise.

Upgrade upstream Brotli to the fixed release for the applicable branch: 1.0.10, 1.1.1, or 1.2.1, or a subsequent fixed release. Alternatively, apply the upstream decoder fix that propagates block-switch errors through both safe and fast paths and introduces BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17). Update Node.js to 22.23.4, 24.22.1, or 26.12.1 or later in the respective branch; migrate unsupported release lines. Update Bun to at least 1.4.4, Python Brotli to at least 1.2.1, and brotlicffi to at least 1.2.1.0. Inventory dynamically linked, vendored, and statically embedded decoder copies, including those inside runtimes, wheels, containers, and compiled applications. Apply distribution or product-specific security updates, rebuild affected artifacts and compiled Bun executables, redeploy, and restart processes. Verify the decoder actually used by running workloads; distribution backports and system-linked libraries make upstream version checks alone insufficient.

Public exploits

Exploits

9 exploits validated by Mallory's analysis. Hidden: 32 rejected by Mallory's analysis as not a working exploit.

View more in app →

CVE-2026-111497-POCThe supplied repository contains eight files, including four code files: two Python scripts, one C harness, and one JavaScript probe. It is a standalone local exploit demonstration, not a framework module. The listed file sizes total 27,250 bytes; the repository URL, analyzed Git reference, and archive size were not supplied, so the repository metadata uses empty strings and a zero size placeholder. The trigger targets the issue identified by the repository as CVE-2026-111497. gen_trigger.py constructs a malformed Brotli stream using 2^24 zero-output dictionary transformations to exhaust the distance-block counter. According to the code and accompanying explanation, the vulnerable decoder incorrectly reports the structural error as NEEDS_MORE_INPUT. A second input chunk then causes the streaming retry path to append beyond an eight-byte internal buffer, corrupting pos, max_backward_distance, and max_distance. This enables a 16-byte ring-buffer-relative write at a controlled signed 32-bit offset. poc.py fetches exact upstream revisions, builds vulnerable and fixed non-PIE harnesses in a pinned container, measures the allocation layout, resolves system@plt and the command-string address, and generates the tuned stream. The C harness supplies the two input chunks and destroys the decoder, triggering the overwritten cleanup callback. The driver checks for a fresh, exact command marker in two independent vulnerable runs and requires the fixed control to return failure without creating that marker. The fixed Brotli revision is 0ed4268a4401abcb4472096340477cf4af7d1a2b. scripts/node-two-chunk-probe.js exercises the same streaming boundary through Node.js zlib, accepts a signed position argument, and optionally writes captured output. Capture defaults to 16 MiB and a 1,000 ms timeout, with environment-variable overrides. The supplied documentation reports an access-violation crash on Windows x64 Node.js 24.9.0 and bounded memory disclosure on Linux, including allocator pointers. It states that the tested stock Linux allocation layout placed the callback beyond the first signed-32-bit write's reach. Node.js 24.22.1 is documented as rejecting the stream with ERR__ERROR_FORMAT_BLOCK_SWITCH. Portable stock-Node command execution is explicitly not demonstrated. README.md explains operation and limitations; docs/evidence/verified-proof.txt records claimed local results and hashes; .gitattributes and .gitignore provide repository housekeeping. The code contains no remote-target interaction, listener, or exfiltration channel. Network activity is limited to source retrieval and possible Docker image retrieval. Static inspection supports the described exploit structure, but the supplied execution evidence and CVE attribution were not independently verified.dimasma0305 · Disclosed Oct 22, 2026 · python · c · file · localOperational CVE-2026-111497-brotli-pwnThe supplied repository contains 12 files: four JavaScript programs, two Python generators, a shell launcher, a Dockerfile, two Markdown documents, and two ignore files. It is standalone research code rather than a framework module. Analysis is static; the claimed CVE, affected versions, and successful demonstrations were not independently verified. The README is partially truncated, and no repository URL, revision, or archive size was provided; empty strings and zero represent unavailable repository metadata. The poc/ directory implements two attack paths. dos.js submits a 22-byte malformed seed plus padding to brotliDecompressSync; gen_dos.py writes the equivalent input to disk. The default payload is 86 bytes and is intended to block the Node.js main thread in a decoder loop. gen_stream.py constructs an approximately 23 MB stream containing zero-output dictionary-transform commands to exhaust decoder bookkeeping. pwn_local.js feeds that stream through the private Brotli handle, scans its own memory for decoder state, and submits a second malformed write. The intended chain corrupts position/distance fields, obtains a relative 16-byte write, replaces free_func and its opaque argument with system() and a command address, and triggers the callback by closing the decoder. A critical implementation defect undermines the supplied local exploit: state starts at -1 and delta at 0, but candidate selection requires !state or abs(candidate_delta) < abs(delta). Both conditions are false for every admitted nonzero candidate delta, so state is never updated and the script exits with 'no-state'. Consequently, the provided code does not substantiate the README's repeatable command-execution claim as written. Other limitations include a build-specific system() offset, stack-based command discovery, layout-dependent wrap compensation, and weaker candidate validation than described in the notes. The maturity classification reflects its supplied operational command payload, not verified reliability. The lab/ directory is a separate, intentionally vulnerable memory-disclosure fixture, not an exploit for a real image-decoder CVE. img_server.js returns incompletely initialized Buffer.allocUnsafe image data as lossless PNG pixels and exposes /warm to recycle Brotli objects. img_leak_probe.js repeatedly requests those endpoints and prints pointer-like pixel values. It does not integrate those leaks into the command-execution chain. The server binds port 8081 without an explicit loopback restriction. The Docker launcher prepares the generated stream, attempts exploitation with deterministic-layout options, and runs a five-second DoS check. Its error handling does not distinguish a timeout from other failures, so the 'still spinning' message alone is not proof of vulnerability. Documentation describes inspector-assisted memory inspection and additional HTTP file-read/staging experiments, but those fixtures are not included. The repository explicitly reports that remote blind RCE was not achieved because address discovery, decoder identification, and write placement remained unreliable. No command-and-control or external exfiltration endpoint is present.TheFool-TAROT · Disclosed Oct 22, 2026 · javascript · python · local · file · networkOperational CVE-2026-111497Standalone research repository containing 25 files: six nonempty Python modules, three JavaScript lab servers, three empty Python package initializers, three Dockerfiles, Compose and package configuration, and documentation. The nine code files counted here exclude empty initializers and build/configuration files. Listed file sizes total 66,675 bytes; archive size and Git reference were not supplied. The repository URL is inferred from Docker image source labels. The repository attributes a Brotli block-switch validation flaw to CVE-2026-111497 and claims fixes in Node.js 22.23.4, 24.22.1, and 26.12.1. These identifiers, affected ranges, release claims, and reported execution results were not independently verified. trigger/brotli_stream.py constructs large malformed streams and staged continuation records; trigger/payload.py builds a fixed id proof payload using hardcoded addresses for Node.js 24.9.0. exploit/dos_express.py submits a two-stage chunked Brotli request and checks service availability. exploit/rce_worker.py coordinates groom and poison connections to a custom framed TCP server. exploit/rce_express_worker.py attempts the same strategy over HTTP with retries and callback verification. The documentation reports successful framed TCP lab RCE, but explicitly says stock Express network-only RCE was not reproduced and the hybrid HTTP lab achieved crashes rather than RCE. Its hybrid server uses node:http, not Express, and accepts any POST path; /upload is the client's chosen path. The Worker environments are digest-pinned, while the Express DoS environment uses node:24.22.0-bookworm and an unpinned Express ^5.3.0 dependency. Research documents discuss allocation boundaries, ASLR, debugger-assisted execution, and a disclosure gadget; no automated disclosure stage is implemented. Static review raises additional reliability concerns. The RCE generator labels a prefix block as metadata, but its MNIBBLES encoding does not match Brotli's metadata marker; moreover, actual Brotli metadata is not decompressed into the output ring buffer. This undermines the claimed prefix-placement mechanism. Research documents also disagree on decoder callback offsets. Consequently, the included payloads should not be treated as verified working exploits merely because the README claims successful results. There is no clear operator-directed malware or destructive installer establishing that this is a fake exploit. scanner/detect.py actively probes Brotli handling rather than passively observing traffic. Contrary to the two-request description, it normally sends a HEAD request plus two POSTs, with a fourth request in verbose mode. Status divergence and X-Powered-By can suggest decompression or Express exposure, but cannot establish Node.js version, this CVE, or exploitability. Third-party domains mentioned in research are documentary claims, not hardcoded scan targets or callback destinations. The scripts enforce loopback for exploitation, but their preliminary health checks occur before that enforcement, and callback listeners default to all IPv4 interfaces.Arkango · Disclosed Oct 23, 2026 · python · javascript · network · webOperational Node2Shell-CVE-2026-111497The repository contains two standalone Python CLI programs, a Portuguese README, and an Unlicense file. The listed file sizes total 74,012 bytes; the repository URL, git reference, and actual archive size were not supplied, so their metadata fields are empty or zero. Both Python files and the README contain substantial truncation markers in the supplied content. poc.py exposes version checking, Brotli endpoint testing, discovery across 18 common HTTP routes, crash attempts, and an HTTP fetch-trap server. Its visible code includes a least-significant-bit-first bitstream writer and an optional Brotli encoder with a static fallback. Despite its checking interface, it is not purely passive: --check is documented as including a crash test. exploit.py advertises an HTTP heap-grooming and malformed-Brotli spray chain intended to overwrite an adjacent ArrayBuffer callback and achieve execution. The visible dispatcher offers command execution, reverse shells, system information, uploads, downloads, and JSON reporting. Visible post-exploitation helpers perform privilege and secret reconnaissance and attempt recurring cron reverse shells. SSH persistence is mentioned, but its implementation is truncated. The code also disables urllib3 TLS warnings, provides randomized user-agent strings, and tests callback-listener connectivity. The repository attributes the issue to DecodeBlockTypeAndLength() confusing input exhaustion with a fatal block-switch format error. However, the malformed-stream construction, grooming implementation, callback overwrite, and RCE validation routines are not available in full. The claimed CVE, advisory references, affected versions, and patch commit cannot be independently verified from this material. The Brotli version statements are internally ambiguous, and the visible reverse-shell dispatch marks RCE true after invoking the attempt without showing independent success verification. Consequently, this is classified as an exploit implementation with basic payloads, not as demonstrated working RCE; there is insufficient evidence to label it deliberately fake. Fingerprintable behavior centers on HTTP requests using Content-Encoding: br, common JSON/API route probes, configurable fetch-trap listeners, and configurable shell callbacks. No fixed production victim, exfiltration service, or command-and-control domain is evident. Documentation reference URLs are citations rather than observed outbound destinations.Ghost-Bx1 · Disclosed Oct 23, 2026 · python · web · networkOperational cve-2026-111497-brotli-pocStatic analysis of the supplied 39-file repository identifies a standalone decoder-level memory-corruption demonstration, not a framework module or remote exploit. It contains 22 code files: 11 C sources, one C header, six Python scripts, and four Bash scripts. No original repository URL, analyzed Git reference, or archive size was supplied; empty strings and zero represent unavailable metadata. The root directory implements Parts A and B. gen_payload.py constructs a malformed Brotli stream. diverge.c feeds it once to BrotliDecoderDecompressStream and reports the result; asan_probe.c resumes decoding with repeated small tails. The stated root cause is that Brotli 1.2.0's unsafe command path ignores a failed illegal distance-block switch, whereas the comparison build checks the failure. The supplied asp_120.log records an AddressSanitizer SEGV caused by a write through memmove16 in ProcessCommandsInternal. This supports a memory-corruption finding, but the code and logs were not independently executed or validated. The directed_write directory implements Part C: a two-stage generator, C harness, source-instrumentation transform, and build/test drivers. It attempts to demonstrate control of a 16-byte copy's content and ring-buffer-relative destination. Importantly, the instrumentation records operands before the copy, so a record alone does not establish successful completion of an arbitrary write. It logs every execution of the selected copy site without an explicit bounds check. The demonstrated offsets also have layout-dependent slack; this is not a proven unrestricted arbitrary-address write or full RCE chain. The scratch directory contains earlier C/Python fuzzers, streaming and one-shot harnesses, traces, and diagnostic logs, including unsuccessful fuzzing runs and inconsistent earlier test outcomes. Some experimental harnesses have bookkeeping/control-flow defects, so their status labels should not be treated as authoritative evidence. Reproducibility issues are visible: crafted.bin is absent and neither root runner generates it automatically; root build.sh passes build-tree include paths into run_poc.sh despite initially compiling with source-tree include paths. Both build scripts also erase the same fixed temporary build directory. These cleanup commands are consistent with build maintenance, not evidence of a malicious fake exploit. The only explicit network operation is cloning Google's Brotli repository for dependencies. There are no target URLs, listening ports, callbacks, exfiltration destinations, or HTTP delivery routines. HTTP2Shell/Node2Shell branding, CVE-2026-111497 attribution, and claimed fixes in 1.0.10/1.1.1/1.2.1 originate from repository text and are not independently verified here. The implemented capability is local malformed-input exploitation with sanitizer diagnostics, not demonstrated compromise of Node.js or an HTTP service.utkarsssh17 · Disclosed Oct 24, 2026 · c · python · local · fileOperational CVE-2026-111497This standalone research repository contains 34 files, including 24 source/script files: 18 JavaScript files, three C drivers, one C++ snapshot, and two Bash scripts. analysis/ holds standalone Brotli test drivers and Node.js zlib implementation snapshots; lab/ contains two Docker Compose configurations, test/cleanup scripts, and 17 JavaScript payload, exploit, victim, and fuzzing utilities; reports/ contains the claimed reproduction results. Root files provide documentation, licensing, citation metadata, and security policy. The described flaw conflates an illegal Brotli block switch with a recoverable need for additional input. The report attributes persistent decoder spinning and an eight-byte internal-buffer overflow to this state confusion. Most scripts classify the runtime through the presence of BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH and compare errno -9 with the patched errno -17. These differences indicate decoder behavior, not independent proof of an out-of-bounds write. The strongest implemented attack is exploit-dos.js: it sends padded malformed streams to POST /decode and probes GET /health. The supplied victim uses brotliDecompressSync, so the demonstrated failure mode is main-event-loop blocking, not libuv worker-pool exhaustion. Worker exhaustion is discussed and streaming experiments are supplied, but this HTTP victim does not demonstrate it. The report claims the vulnerable container becomes unresponsive while the patched container returns HTTP 400; those results were not independently executed or verified here. RCE claims materially exceed implementation. exploit-rce.js directly invokes child_process.execSync with an operator-controlled command, defaulting to id, in the process already running the script; it does so even when its preceding alleged corruption stage fails. This is not vulnerability-mediated code execution. exploit-rce-v2.js only classifies inputs and prints exploitation possibilities. weaponize.js contains a zero-filled ROP placeholder, and payload-builder.js explicitly acknowledges its bitstream builder is incomplete. Consequently, the repository is not a working remote RCE exploit, although it contains substantive DoS and diagnostic code. The log-cleanup rm -rf operation is scoped to lab logs and does not by itself indicate a malicious fake repository. Network activity is predominantly loopback lab traffic; the general HTTP client additionally supports an arbitrary configured host. There is no implemented callback shell, exfiltration destination, or command-and-control channel. Express/body-parser and outbound fetch are implemented test surfaces; axios and Bun coverage appears only in documentation. The full runner references a missing binary payload and assumes an existing logs directory, so it is not complete as supplied. Two upstream snapshots are truncated in the provided content. CVE identity, affected versions, upstream references, and reported outcomes remain repository claims. The repository URL is inferred from citation metadata; no analyzed Git ref, archive path, or archive byte size was supplied, so the ref is blank and size_bytes is 0 to denote unavailable metadata.googlesky · Disclosed Oct 24, 2026 · javascript · c · network · web · localOperational CVE-2026-111497-ToolkitThe repository contains two standalone Python command-line programs, README.md, an MIT LICENSE, .gitignore, and requirement.txt. Both programs have main-entry guards and use standard-library imports in the visible excerpts; requirement.txt contains only a comment asserting no dependencies. No established exploit framework is identified. exploit.py implements a bit-level stream writer and malformed Brotli generators for crash/DoS and amplification attempts. Its visible main routine supports single-target and mass-scan dispatch, reporting, dry runs, and a lab-RCE mode. That mode selects either framed TCP to a Worker listener or an HTTP fetch-triggering endpoint according to a target profile. The README additionally advertises SOCKS5/Tor, jitter, rate limiting, user-agent rotation, and WAF/version fingerprinting, although the relevant implementation is largely truncated. verifier.py is the detection-oriented companion. It constructs regression and truncated streams, accepts individual targets or target-list files, expands CIDRs, deduplicates targets, and dispatches asynchronous checks. The README describes classification using early Brotli error -17 versus late error -9 and HTTP-response differences. The actual classification logic is omitted. Its claim of harmless verification is not established: the visible regression generator closely matches exploit.py's crash-stream generator and constructs a substantial malformed input. The stated vulnerability involves accepting an invalid Brotli block switch, continuing with stale decoder state, and eventually writing beyond a ring buffer. The README claims DoS through Express/body-parser and restricted RCE with fixed-address, non-PIE Worker-thread layouts. These are unverified claims; the supplied material does not establish the CVE's validity, affected-version accuracy, or successful exploitation. Documentation also contains differing statements about RCE feasibility through Express, further limiting confidence. No concrete target URL, callback address, port, HTTP route, registry key, or hardcoded exploitation-related filesystem path is visible in the supplied code. Targets and callback host/port are operator-supplied. README hyperlinks are documentation references rather than demonstrated outbound exploit destinations. Much of both Python files and the README is explicitly truncated, so additional endpoints or behavior may exist in omitted sections. No obvious destructive local commands or exfiltration destinations appear in the visible excerpts. Repository URL, git reference, archive location, and archive byte size were not supplied; the empty repository fields and zero size represent unavailable metadata.tc4dy · Disclosed Oct 24, 2026 · python · network · webOperational HTTP2Shell-PoCThe repository contains one standalone Python script, CVE-2026-111497.py (2,531 bytes), and a short README.md (190 bytes). The script uses Python standard-library HTTP, TLS, argument-parsing, and timing facilities. It is not part of an exploit framework. The intended attack sends a fixed binary payload to an operator-supplied URL with Content-Encoding: br, attempting to crash or hang a server that decompresses the request body. Options support POST or PUT selection, custom headers, a configurable timeout, and disabled TLS certificate verification. There are no hardcoded destination URLs, domains, IP addresses, filesystem targets, registry keys, or callback endpoints. A blocking implementation defect prevents exploitation as supplied: --request/-X populates ns.request, but urllib.request.Request is constructed with method=ns.method. This raises AttributeError before the HTTP operation and outside the exception handler. The default header values also appear reversed: User-Agent defaults to application/json, while Content-Type defaults to CVE-2026-111497-Tester/1.0, potentially affecting server-side body processing. The script labels successful responses and HTTP errors as safe, while treating selected timeouts and connection failures as evidence of a hang or crash. These heuristics cannot establish vulnerability or prove a segmentation fault; ordinary network problems can produce similar symptoms, and some timeout or disconnect exceptions may escape its handlers. The README calls the PoC HTTP2Shell, but the code implements neither a shell nor an explicit HTTP/2 client. No remote command execution, persistence, exfiltration, or post-exploitation functionality is present. The CVE identifier appears in the filename and a header default, but the supplied material does not substantiate the identifier or identify an affected vendor, product, or version. Maturity reflects the presence of a basic hardcoded attack payload, not operational correctness. Repository URL, revision, and archive size were not provided; empty strings and zero represent unavailable metadata.GlobularOne · Disclosed Oct 25, 2026 · python · web · networkOperational node2shellThis standalone reproduction lab contains 15 files, including eight code-bearing files: three Bash scripts, two C programs, two Python programs and an HTML/CSS/JavaScript walkthrough. scripts/setup.sh downloads decoder sources and optionally Node.js runtimes; asan/build.sh produces AddressSanitizer-enabled release-semantics and assertion-enabled harnesses. payload/gen_payload.py constructs malformed Brotli streams, asan/harness.c inspects decoder state and applies a watchdog, and run_ab.sh compares vulnerable and patched builds. asan/dump_tables.c supports dictionary-transform research. Documentation, a payload digest manifest, an A/B transcript and social-card tooling complete the repository. The mechanism described is an unchecked/error-confused block-switch result: an impossible switch is reported as NEEDS_MORE_INPUT, after which the streaming wrapper copies unconsumed bytes beyond its eight-byte temporary buffer. The committed transcript supports a 16-byte overflow on Brotli 1.2.0 and a clean -17 format error on 1.2.1. Documentation additionally reports a CPU-spin denial of service. Because the overflow stays inside the decoder-state allocation, the lab relies on structural checks rather than expecting AddressSanitizer to flag it. This is a memory-corruption/DoS proof of concept, not a demonstrated RCE exploit. The report says its tested path cannot reach decoder pointers and that pos corruption was not developed into a finished exploitation primitive. Some comments retain earlier speculative pointer-reach and cross-meta-block trigger explanations; the final report explicitly narrows those claims. Node.js is discussed as a downstream consumer, but its runtime was not exercised. There is no remote delivery client, listener, shell payload or apparent exfiltration endpoint; network calls shown are dependency downloads. Analysis is static and limited to the supplied material, which truncates portions of the harness, generator, report and walkthrough. CVE attribution, affected ranges and release chronology are repository claims, not independently verified here. The repository URL is inferred from its embedded GitHub reference; no git ref or archive byte size was supplied, so those fields use an empty string and zero respectively.lesterlam · Disclosed Oct 24, 2026 · bash · c · file · localPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Debian ProjectNodejsapplication

GoogleBrotliapplication

Microsoft CorporationNodejs20-Typescriptapplication

NodejsNodejsapplication

NodejsNodejs20application

NodejsNodejs24application

External references

References

MITRE CVEcve.org · CVE-2026-111497 NVDnvd.nist.gov/vuln/detail/CVE-2026-111497 MITRE CWE · CWE-787Out-of-bounds Write openwall.comopenwall.com/lists/oss-security/2026/10/23/25 openwall.comopenwall.com/lists/oss-security/2026/10/24/6 github.comgithub.com/advisories/GHSA-9v8h-qqgm-4m35 lists.debian.orglists.debian.org/debian-lts-announce/2026/10/msg00049.html nodejs.orgnodejs.org/en/blog/vulnerability/october-2026-security-releases

Activity feed

Recent activity

369 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

phoenix security blogNews · Oct 25, 2026HTTP2Shell CVE-2026-111497: Brotli RCE in Node.js and Python - Phoenix SecurityA critical heap-corruption vulnerability in Google's reference C Brotli decoder, rated CVSS 4.0 9.2 by the CNA. Incorrect handling of an invalid block switch and an unchecked return value allow crafted compressed input to overflow an eight-byte internal buffer, potentially causing memory disclosure, crashes, or remote code execution. Exposure includes inbound compressed request bodies, automatically decoded outbound HTTP responses, and files processed by applications embedding the decoder. Imperva demonstrated private code execution against stock Node.js 24.22.0 on Linux arm64; published exploit code reportedly achieves execution only on deliberately weakened builds. The article reports no in-the-wild exploitation. Patches exist for upstream Brotli and several major downstream products, but many vendored copies remain unpatched. Mitigations include rejecting Brotli request bodies before decompression, disabling automatic Brotli response decoding, removing optional vulnerable Python packages, and restricting untrusted file processing.Read more ↗fedora bodhi security updatesNews · Oct 25, 2026FEDORA-2026-6a639d1308 - security update for brotli and perl-Alien-Brotli - Fedora Updates SystemAn out-of-bounds write vulnerability in the Google Brotli decoder, addressed in upstream Brotli 1.2.1. Fedora 45 classifies the security update as high severity. The update includes brotli-1.2.1-1.fc45 and perl-Alien-Brotli-0.2.2-16.fc45 and has passed test gating, but stable deployment is blocked until the Fedora 45 release freeze is lifted. Exploitation details and affected version ranges are not provided.Read more ↗nuclei templates pull requestsNews · Oct 25, 2026CVE-2026-111497 - Node.js Brotli Decoder <=26.12.0 - OOB Write Detection (node2shell) by DhiyaneshGeek · Pull Request #17522 · projectdiscovery/nuclei-templatesAn out-of-bounds write vulnerability in the Node.js Brotli decoder, identified as affecting versions up to and including 26.12.0. The fragment references detection-related code review activity but provides no substantive exploitation or remediation details.Read more ↗csirt bjNews · Oct 24, 2026Exécution de code à distance affectant Brotli - bjCSIRTThe advisory describes a critical buffer overflow in the Brotli decoder (c/dec/decode.c), rated CVSS v3.1 9.8. An unauthenticated attacker could supply a specially crafted Brotli-compressed stream to corrupt decoder state memory, potentially causing sensitive-memory disclosure, denial of service, or remote arbitrary code execution. Products incorporating vulnerable decoder versions may also be affected.Read more ↗

+10 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity186Community discussion across Reddit, Mastodon, and other social sources.