.svg)
Truvo Incident Tracker
Brotli decoder flaw: CVE-2026-111497
A memory corruption flaw in Google's Brotli decoder affects Node.js, .NET, Bun, Python packages, Envoy and PHP's Windows builds. Google fixed the library on October 21, 2026, and vendors shipped fixes over the following week. This page tracks what is confirmed, what is still unknown, and what to do, with each fact dated and sourced.
Talk to incident response
Share what happened and a consultant will follow up to book a call.
Brotli flaw key facts
| CVE | CVE-2026-111497, an out-of-bounds write in the Brotli C decoder (CWE-787). Also called Node2Shell, HTTP2Shell and Broccoli2Shell |
| Severity | CVSS v4.0 9.2 Critical (Google). CVSS v3.1 8.1 High (Microsoft). High (Node.js) |
| Brotli fixed in | Brotli 1.0.10, 1.1.1 and 1.2.1 (released October 21, 2026). Affected from 1.0.3 |
| Vendor fixes | Node.js 26.12.1, 24.22.1, 22.23.4. .NET 10.0.14, 9.0.22, 8.0.33. Bun 1.4.4. Python Brotli 1.2.1, brotlicffi 1.2.1.0. Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12. PHP for Windows 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 |
| No confirmed fix | PowerShell 7.4, 7.5 and 7.6 as of October 27, 2026. Node.js 25, 23, 20 and older lines get no fix |
| Exposed when | Software decompresses Brotli data it did not create: request bodies, responses fetched from other servers, or files |
| Exploitation | No attacks reported as of October 27, 2026. Imperva showed code execution on an official Node.js 24.22.0 build, not yet released |
| CISA KEV | Not listed as of October 27, 2026 |
Check your software for the Brotli flaw
Look up the version of a runtime or package, or copy the read-only self-check script and run the script on your servers. The script reads installed versions and sends nothing anywhere. The domain check reads response headers only, so treat the domain result as a hint. The same tool is available as a standalone Brotli vulnerability checker.
What is confirmed and what is still unknown about the Brotli flaw
Confirmed
- The bug is in the Brotli C decoder (c/dec/decode.c): an invalid block switch was treated as a need for more input, so the decoder kept writing past an 8-byte buffer (Node.js advisory)
- Node.js is affected through node:zlib Brotli decompression in all supported lines, fixed October 21 (Node.js advisory)
- .NET is affected only when an app turns on Brotli decompression: ASP.NET Core request decompression, HttpClient AutomaticDecompression set to Brotli or All, or BrotliStream on untrusted data. .NET Framework is not affected (Microsoft, dotnet/announcements#494)
- Self-contained and NativeAOT .NET apps carry their own copy and must be rebuilt with a patched SDK (Microsoft)
- Python requests, urllib3, httpx and aiohttp decode br responses automatically when Brotli or brotlicffi is installed (GitHub advisory GHSA-9v8h-qqgm-4m35)
- Envoy is affected only when the Brotli decompressor filter is configured (Envoy advisory GHSA-3wvj-j6qm-62mr)
- PHP rebuilt the Windows packages on October 26. php -v shows the same version as the first build (php.net)
Not yet known
- When Microsoft will ship a fixed PowerShell 7 build
- Whether nginx with ngx_brotli, browsers, and pure Go, Rust or Java Brotli ports are affected. No primary source has said
- Which Linux distributions have shipped patched libbrotli packages, beyond what each vendor tracker shows
- Whether working exploits will be released for common setups. The demonstrated Node.js exploit did not work every time
What to do about the Brotli flaw, step by step
Find every copy first, because Brotli is bundled inside runtimes and compiled apps. Then patch in order of exposure, using the NIST SP 800-61 phases. No attacks have been reported, so most teams can treat the flaw as a patching job with a short check for signs of misuse.
1. Inventory
- Run the self-check script on every server and inside every container image
- List self-contained .NET apps, NativeAOT apps and bun build --compile executables
- List services that accept Content-Encoding: br request bodies or fetch br responses from other servers
2. Remediation
- Upgrade to the fixed releases and rebuild container images
- Rebuild self-contained and compiled apps with a patched toolchain and redeploy
- If patching must wait: turn off Brotli request decompression and automatic br decoding of untrusted responses
3. Detection and analysis
- Look for worker crashes, memory errors and restarts in services that decompress Brotli
- Record per service: not exposed, patched, or needs review
4. Containment and recovery
- Only for services with signs of compromise: isolate, rotate the credentials the service held, and rebuild from a known-good image
5. Post-incident activity
- Add bundled libraries such as Brotli to the software inventory
- Set an upgrade date or a formal risk acceptance for end-of-life runtimes
Brotli flaw obligations under SOC 2, ISO 27001, GDPR, HIPAA and Canadian privacy law
A vulnerability is not a breach. Patching and checking for misuse is vulnerability management under SOC 2 and ISO 27001. Privacy laws apply only if personal data or PHI was compromised.
| Framework or law | When it applies | What it asks for | Clock |
|---|---|---|---|
| SOC 2 Framework | Always, for systems in scope | Detect and patch (CC7.1), evaluate the event (CC7.3), respond and recover if exploited (CC7.4, CC7.5) | None set by SOC 2. Your policy and customer contracts |
| ISO 27001:2022 Framework | Always, for systems in scope | Technical vulnerability management (A.8.8), event decision (A.5.25), incident response (A.5.26-A.5.28) | None set by ISO. Your procedure |
| GDPR Law | Exploitation led to personal data being compromised | Notify the supervisory authority unless unlikely to result in risk. Tell individuals if high risk. Document every breach | 72 hours from reasonable certainty of a breach |
| HIPAA Law | Attempted access is a security incident. PHI accessed is a presumed breach | Document incidents. Four-factor risk assessment. Notify individuals, HHS and media as required | Individuals within 60 days of discovery |
| PIPEDA Law | Breach of security safeguards with real risk of significant harm | Report to the OPC and notify individuals. Record every breach | As soon as feasible. Keep records 24 months |
| Quebec Law 25 Law | Confidentiality incident with risk of serious injury | Notify the CAI and affected people. Register every incident | Promptly |
Need help finding every copy of Brotli?
Brotli hides inside runtimes, proxies, packages and compiled apps. Truvo's team inventories where the decoder runs, patches and rebuilds what needs it, and leaves the evidence your auditor will ask for.
Brotli flaw: questions and answers
Yes. All three names refer to CVE-2026-111497 in Google's Brotli decoder. Different researchers and news outlets used different names as fixes reached Node.js, HTTP stacks and .NET.
Node.js 26.12.1, 24.22.1 and 22.23.4. .NET runtime 10.0.14, 9.0.22 and 8.0.33. Bun 1.4.4. Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. PHP for Windows 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The Brotli library itself is fixed in 1.0.10, 1.1.1 and 1.2.1.
No. The flaw is in decompression. Exposure comes from software that decompresses Brotli data it did not create, such as request bodies, responses fetched from other servers, or uploaded files.
Updating the shared runtime fixes apps that use the shared runtime. Self-contained and NativeAOT apps carry their own copy of the decoder, so rebuild those apps with a patched SDK and redeploy.
No attacks had been reported as of October 27, 2026, and CISA had not added the CVE to the Known Exploited Vulnerabilities catalog. Imperva showed code execution on an official Node.js 24.22.0 build but has not released the exploit.
Sources
- CVE-2026-111497 record (Google, CNA) (Oct 21, 2026)
- Google Brotli releases 1.0.10, 1.1.1, 1.2.1 (Oct 21, 2026)
- Node.js October 2026 security releases (Oct 21, 2026)
- Microsoft .NET security announcement (dotnet/announcements#494) (Oct 2026)
- Bun v1.4.4 (Oct 22, 2026)
- GitHub advisory GHSA-9v8h-qqgm-4m35 (Python Brotli, brotlicffi) (Oct 22, 2026)
- Envoy advisory GHSA-3wvj-j6qm-62mr (Oct 2026)
- PHP for Windows rebuilt packages (Oct 26, 2026)
- The Hacker News: Node2Shell exploit on an official Node.js build (Oct 23, 2026)
Change log
- Oct 27, 2026: Tracker and Brotli vulnerability checker published, with read-only self-check scripts for Linux, macOS and Windows. Facts as of 14:00 UTC.