Broccoli2Shell
CVE-2026-111497Brotli decoder memory corruption lets remote attackers run code or crash apps
The flaw is a buffer overflow in the Google Brotli decompression library: a crafted Brotli-compressed stream can make the decoder write outside a reserved memory area. A remote unauthenticated attacker could use this to expose memory contents, cause a denial of service, or execute arbitrary code. It affects Brotli versions 1.0.3 through 1.2.0, is on CISA's known-exploited list meaning attackers are using it, and fixed versions 1.0.10, 1.1.1, and 1.2.1 are available.
Google Brotli · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 27 Oct; US agencies must fix by 10 Nov
SeveritycriticalCVSS 9.2 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Brotli 1.2 | 1.2.1 |
| Brotli 1.1 | 1.1.1 |
| Brotli 1.0 | 1.0.10 |
What to do
- Update any Brotli libraries or binaries in the 1.0.3 to 1.2.0 range to 1.0.10, 1.1.1, or 1.2.1 depending on your release line.
- Apply emergency vendor patches for affected platforms, including Microsoft's out-of-band .NET updates and PHP's Windows security update.
- Check vendor advisories for Brotli-dependent products such as Palo Alto Networks and Cisco for their patched versions.
- Treat this as urgent because CISA added it to the known-exploited list and US federal agencies must fix it by 2026-11-10.
What happened
- 26 OctMicrosoft released out-of-band .NET security patches for the critical Brotli flaw.
- 26 OctBleepingComputer reported the vulnerability as 'HTTP2Shell' and said it triggered emergency patches.
- 26 OctPHP issued a second Windows security update in five days to fix the Brotli code execution flaw.
- 27 OctCISA added the vulnerability to its known-exploited catalog with a US federal agency fix deadline of 2026-11-10.
- 27 OctHelp Net Security reported that the Brotli bug reaches far beyond Node.js.
- 28 OctPalo Alto Networks published a portfolio status saying the impact on its products is critical.
- 28 OctThe Hacker News reported Brotli exploit traffic emerging alongside Adobe Commerce PolyShell attacks.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | critical 9.2 | 27 Oct | 55% |
Our reporting
26 OctMicrosoft issues emergency .NET patches for critical Brotli flaw ‘Broccoli2Shell’Reported elsewhere
Palo Alto Networks · 28 OctCVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL) ↗The Hacker News · 28 OctAdobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges ↗Help Net Security · 27 OctBrotli bug reaches far beyond Node.js (CVE-2026-111497) ↗CISA · 27 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗Cisco · 27 OctVulnerabilities in node.js Affecting Cisco Products: October 2026 ↗www.theregister.com - Articles · 26 OctMicrosoft releases emergency .NET security fixes for Google Brotli bug ↗The Hacker News · 26 OctPHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw ↗Rapid7 · 26 OctCVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder ↗BleepingComputer · 26 OctCritical 'HTTP2Shell' Brotli vulnerability triggers emergency patches ↗BleepingComputer · 26 OctMicrosoft releases emergency .NET patches for critical Brotli flaw ↗Fortinet · 26 OctMultiple Node.js CVEs ↗The Hacker News · 24 OctBrotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software ↗The Hacker News · 23 OctResearchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data ↗The records
nodejs.org: advisory ↗CISA known-exploited catalog ↗CVE-2026-111497 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works