Truvo Free Tools

Brotli vulnerability checker

CVE-2026-111497 is a memory corruption flaw in Google's Brotli decoder, which ships inside Node.js, .NET, Bun, Python packages, Envoy and PHP's Windows builds. Look up a version, run the read-only self-check script on your servers, or check a domain for hints.

SOC 2 CC7.1ISO 27001 A.8.8

Last updated Oct 27, 2026

Talk to a security specialist

Share what you need and a consultant will follow up to book a call.

How the Brotli checker works

The checker gives three ways to answer the same question. None of them sends Brotli data to anyone, and nothing you enter is stored.

01

Look up

Pick the software and enter the version you run. The checker compares the version with the fixed release for that line, from the vendor advisory, and says whether the software is affected, fixed or end of life.

02

Self-check

Run brotli-check.sh on Linux or macOS, or brotli-check.ps1 on Windows. The script reads the versions installed on that machine, compares each one with the fixed releases and exits with code 1 if something needs attention. The script is read-only and sends nothing anywhere.

03

Hint

Enter a domain, and the checker reads the response headers from one normal page request. Headers can point to Node.js, ASP.NET, Envoy or PHP on Windows. Headers rarely show a version, so a hint tells you which software to check, not whether you are exposed.

Need help finding every copy of Brotli?

Brotli hides inside runtimes, proxies, packages and compiled apps. Truvo's team inventories where the decoder runs, patches and rebuilds what needs it, and leaves the evidence your auditor will ask for.

Talk to Truvo

  • Find every runtime, proxy and package that bundles Brotli

  • Patch, rebuild and redeploy in priority order

  • Check whether any exposed service was attacked

  • Document the response for SOC 2 and ISO 27001

Brotli vulnerability checker: frequently asked questions

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted Brotli data can corrupt memory in the program that decompresses the data and may let an attacker run code. Google fixed the library in Brotli 1.0.10, 1.1.1 and 1.2.1 on October 21, 2026. News coverage calls the flaw Node2Shell, HTTP2Shell and Broccoli2Shell.

Node.js 26.12.1, 24.22.1 and 22.23.4. .NET runtime 10.0.14, 9.0.22 and 8.0.33. Bun 1.4.4. Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. PHP for Windows rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. No fixed PowerShell 7 build had been confirmed as of October 27, 2026.

Serving Brotli is compression, and the flaw is in decompression. A system is exposed when software decompresses Brotli data it did not create, such as request bodies sent with Content-Encoding: br, responses fetched from other servers, or uploaded files.

Yes. The script only runs version commands such as node -v, dotnet --list-runtimes and pip show brotli, compares the results with the fixed releases and prints them. The script sends no data anywhere, writes no files and needs no admin rights. Read the script before you run the script, as with any script from the internet.

The script sees what is on the PATH of the user who runs the script. Run the script inside each container image as well. Self-contained .NET apps, NativeAOT apps and executables made with bun build --compile carry their own copy of the decoder and must be rebuilt with a patched toolchain.