Security1 hOctober 28, 2026, 00:38

Brotli CVE-2026-111497 puts Node.js and other projects at risk

A remotely exploitable out-of-bounds write in Google's Brotli compression library, CVE-2026-111497 (Node2Shell/Brotli2Shell), can corrupt process memory and lead to remote code execution. The fix was committed in February 2026 but releases 1.2.1, 1.1.1 and 1.0.10 shipped only last week; Node.js patched it in 26.12.1, 24.22.1 and 22.23.4.

Help Net Security

Open source

Brotli CVE-2026-111497 puts Node.js and other projects at risk

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder enabling RCE
Fix committed on February 27, 2026, but releases shipped only last week
Affects Node.js 26.x, 24.x, 22.x plus .NET, Bun, Envoy and FFmpeg
Public PoCs are already exploited in the wild from IP 94.154.43.7

#Google#Node.js#Brotli

HTTP2Shell: critical Brotli decoder flaw CVE-2026-111497

Security

CVE-2026-73567: weak RNG in SM2 library let attackers recover keys

Security

Multer DoS flaw CVE-2026-113872 lets one request crash Node.js servers

Security

Brotli CVE-2026-111497 puts Node.js and other projects at risk

HTTP2Shell: critical Brotli decoder flaw CVE-2026-111497

CVE-2026-73567: weak RNG in SM2 library let attackers recover keys

Multer DoS flaw CVE-2026-113872 lets one request crash Node.js servers

Node.js undici DoS via orphaned stream: CVE-2026-109869