https://reddit.com/r/sysadmin/comments/1xf8q6q/woff2shell_the_brotli_0day_cve2026111497_is_a/: WOFF2SHELL: The Brotli 0-day (CVE-2026-111497) is a bidirectional nuke hiding in web fonts.
Published Oct 25, 2026
·Updated
Affected Software
2 affected components
Google Woff2
Google Brotli=1.0.3
Frequently Asked Questions
1
Which deployments are potentially exposed?
Deployments that process untrusted WOFF2 fonts through woff2_decompress may be exposed. The cited concern is specifically the woff2 Makefile build that includes a private Brotli decoder copy.
2
What bundled dependency version is identified as affected?
The reported woff2 build bundles Brotli 1.0.3. The source describes that bundled version as critically vulnerable.
3
Is a fix available for the bundled decoder issue?
The issue is reported as tracked in issue #207, with a proposed fix in PR #208. The provided information does not state that the proposed fix has been merged or released.