Google Project Zero has now published their analysis at: https://project-zero.issues.chromium.org/issues/565308158
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
On 21 October 2026, Google released patched versions of its Brotli compression library for CVE-2026-111497, a vulnerability nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder that gives remote code execution with no login. Your package manager can show a patched libbrotli while apps are still vulnerable, because Node, many Python stacks and vendor appliances bundle their own copy.
I made an interactive, hands-on lab exercise on this vulnerability. The goal is to give a general overview of the attack vector and the mitigation steps. You'll send requests as an attacker to exploit it, then switch roles to the defender's side and contain it.
I did my best to highlight all the details, but if you notice any issues or inconsistencies, please let me know!
https://ransomleak.com/exercises/http2shell-rce/
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release. The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory:CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code executionCVE-2026-105482 - DNS resolution truncation involving embedded NUL charactersCVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digitsCVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addressesFor information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026This investigation was expanded to cover Brotli outside of Node.js on October 30, 2026. The Brotli decoder flaw (CVE-2026-111497), which is in the Google Brotli C decoder, is often bundled with or linked to other software, so products beyond Node.js may be affected. For software that may be affected, see Broccoli2Shell.Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.This advisory will be updated as additional information becomes available.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u
Regards, -- l=2001;main(i){float o,O,,I,D;for(;O=I=l/571.-1.75,l;)for(putchar(--l%80? i:10),o=D=l%80.05-2,i=31;=OO,O=2oO+I,o=oo-+D,o++<4+D&i++<87;);puts (" Harry 'Piru' Sintonen <sintonen () iki fi> https://www.iki.fi/sintonen";);}
On 10/25/26 19:03, Alan Coopersmith wrote: For instance, Ghostscript appears to have brought in the fix to it's bundled copy of brotli in their 10.07.1rc1 release: in which you can see the changes are present from Sorry, copy & paste error - the second URL should have been: https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
On 10/24/26 09:34, Alan Coopersmith wrote: Yes, https://patchtheplanet.org/brotli reports this as well.
https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.
The patchtheplanet page lists releases from Node.js, Bun, Envoy Proxy, & Istio incorporating it and gives suggestions on what other software to check. https://broccoli2shell.com/ lists even more including: - .NET runtime - 7-Zip-zstd - Apache Arrow - Brotli4j - brotlicffi - CatBoost - Chromium - ClickHouse - DuckDB - EDK II - Firefox - Ghostscript - GraalJS (graal-nodejs) - libjxl - MuPDF - NanaZip - ngxbrotli - p7zip - PHP brotli extension - Ruby brotli gem - SumatraPDF - UEFITool - v8-jsi - woff2 - YDB - YTsaurus
Some of these fixed it unknowingly, by pulling in updates from the Google brotli repo before the vulnerability was announced.
For instance, Ghostscript appears to have brought in the fix to it's bundled copy of brotli in their 10.07.1rc1 release: https://github.com/ArtifexSoftware/ghostpdl/commit/0f318d9a288a4016b8a3ef11a52e536443aa8e2b in which you can see the changes are present from https://github.com/ArtifexSoftware/ghostpdl/commit/0f318d9a288a4016b8a3ef11a52e536443aa8e2b
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
https://github.com/Kludex/mangum/issues/160
I believe I may have found proof that WOFF2 is vulnerable to the Brotli zero-day, and the entire industry is looking the wrong way.
We are busy patching Node.js and Python HTTP servers, but a site tracking bundled decoders called Broccoli2Shell published a table on October 24th. It lists projects that hardcoded their own private copies of the vulnerable Brotli C decoder:
Project: woff2 (Makefile build) Bundled Copy: Brotli 1.0.3 (Critically vulnerable) Input it decodes: WOFF2 fonts passed to woff2\decompress Status: "Tracked in issue #207. A fix has been proposed in PR #208."
The maintainers of the font-compression library know it's vulnerable, but because it’s a C-library issue and not a flashy web-server exploit, it isn't making headlines.
Why this takes down servers too: You might think, "Fonts are a client-side problem." Look at Kludex/mangum Issue #160: issue in reading .woff/.ttf/.woff2.
It throws a Unicode decode error. So what?
So what? It means your middleware touches the file. If you don't explicitly whitelist the media type in AWS API Gateway, the gateway tries to unpack the WOFF2 file to read the body. And what algorithm does WOFF2 use to compress its data? Brotli.
If your firewall/middleware checks the file, the firewall dies. If the firewall ignores the file, it passes to the client... and the client dies. It's a bidirectional nuke. And right now, there are millions of malicious WOFF2 files sitting in AWS buckets, just waiting for someone to request them.
On 10/23/26 12:12, Jan Schaumann wrote: Alan Coopersmith <alan.coopersmith () oracle com> wrote: Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)
A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.
This vulnerability affects Node.js 26.x, 24.x, and 22.x. It's not quite obvious from this advisory, but the underlying problem is not restricted to Node.js alone, but rather in Google brotli:
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
This trickles down into any consumer, including, e.g., Envoy:
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr Yes, https://patchtheplanet.org/brotli reports this as well.
https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.
The patchtheplanet page lists releases from Node.js, Bun, Envoy Proxy, & Istio incorporating it and gives suggestions on what other software to check.
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 adds the PyPi brotli packages to the list as well.
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
On 2026-10-23 15:12:16, Jan Schaumann wrote: This trickles down into any consumer Only those dumb enough to bundle or statically link their dependencies. The bare minimum in terms of software engineering would prevent these 1990-ass vulnerabilities.
(NodeJS has a --shared-brotli option, so NodeJS should not be an issue for distros that are paying attention.)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Summary
Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.
erl-brotli compiles its own copy of the Google Brotli C sources under csrc into a NIF, and brotlidecoderdecompressstream in csrc/brotlinif.c hands the input to BrotliDecoderDecompressStream. In csrc/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.
This issue affects brotli: from 0.3.0 before 0.3.4.
Impact
An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it.
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.