Critical Brotli Decoder Flaw Triggers RCE Across Major Runtimes
A critical out-of-bounds write vulnerability in Google's Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Brotli2Shell, Node2Shell, and HTTP2Shell, is causing alarm across the software industry after researchers demonstrated remote code execution (RCE) on unpatched Node.js builds. The flaw, rated 9.2 under CVSS v4.0 by Google as the CVE Numbering Authority (CNA), affects any application that decompresses attacker-controlled Brotli data, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, and PHP for Windows.
According to Tenable's Research Special Operations team, public proofs-of-concept (PoCs) are already available, and ELLIO reported on October 26 that the first exploitation of Node2Shell was observed in the wild. A checker calling itself node2shell-check is reportedly mapping hosts that decompress Brotli, signaling active reconnaissance. Patches have been released for Google Brotli and major runtimes, but some projects had not shipped fixes as of October 26, leaving a window of exposure.
Affected Products and Fixed Versions
Cynet's advisory lists detailed fixed versions: Node.js supported lines require 22.23.4, 24.22.1, or 26.12.1; .NET needs 8.0.33, 9.0.22, or 10.0.14; Bun 1.4.4; Envoy Proxy 1.36.12, 1.37.8, 1.38.6, 1.39.3, or 1.40.0; and Istio 1.29.9, 1.30.6, or 1.31.2. Brotli4j 1.24.0 addresses the issue, but ClickHouse, DuckDB, and Apache Arrow have no patched release yet. Python fixed the flaw in version 1.2.1. Unsupported Node.js lines received no security release.
Why It Matters: Widespread Exposure and Easy Exploitation
The vulnerability originates in the upstream Brotli C decoder, meaning any software that bundles its own copy of Brotli must issue a separate fix. Wiz Research warns that cloud environments are particularly exposed due to the ubiquitous use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services. Internet-facing applications that process attacker-controlled requests, as well as internal services that fetch compressed responses from untrusted external sources, may provide exploitation paths.
Exploitation requires an application or dependency to decompress attacker-controlled Brotli data, either through incoming HTTP requests, externally fetched responses, or other untrusted compressed content. Certain HTTP clients and frameworks perform decompression automatically when Brotli support is enabled, potentially exposing applications even when Brotli is not explicitly referenced in code. Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or achieve RCE with the privileges of the affected process.
The discovery was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security, with fixes implemented by Matteo Collina and Antoine du Hamel (Node.js). Ron Masas of Imperva Red Team demonstrated exploitability, while OpenSourceMalware and Aikido analyzed the Python ecosystem impact. ELLIO reproduced the RCE on x86-64 against four targets, confirming that a malformed Brotli body can yield a shell on an official, unmodified Node.js build.
Perspective: A Supply Chain Wake-Up Call
The Brotli2Shell episode underscores a recurring trend in open-source security: a single vulnerability in a low-level compression library can cascade across dozens of downstream projects and languages. Brotli's role in HTTP compression means it is embedded in everything from web servers to serverless platforms, often invisibly. Organizations frequently lack a complete inventory of which components bundle Brotli, making patch management a challenge.
The rapid publication of PoCs and early scanning activity also highlights the shrinking window between disclosure and exploitation. Defenders must prioritize patching internet-facing services and restart affected processes, as fixes only take effect after a restart. For cloud-native environments, the risk is amplified by the complexity of layers—load balancers, service meshes, and API gateways—each of which may need independent updates.
As Wiz notes, exposure can occur even when developers are unaware that Brotli is in use. This invisibility, combined with the potential for unauthenticated RCE, makes CVE-2026-111497 a top remediation priority. While patches are available for most major runtimes, the absence of fixes for projects like ClickHouse, DuckDB, and Apache Arrow means the full scope of risk may persist for weeks. Enterprises should check dependencies, apply vendor updates, and monitor for unusual child processes or shell execution that could indicate exploitation attempts.
The incident also raises questions about the security of compression libraries broadly. As attackers increasingly target parsing and decompression logic—often written in memory-unsafe languages like C—the need for memory-safe alternatives and rigorous fuzzing becomes more urgent. For now, security teams are advised to treat any service that handles Brotli-compressed data from untrusted sources as potentially vulnerable until proven otherwise.
Comments