Detections
Analytics
CVE-2026-111497
critical
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
References
https://cert-portal.siemens.com/productcert/html/ssa-678870.html
https://cert-portal.siemens.com/productcert/html/ssa-242944.html
https://cert-portal.siemens.com/productcert/html/ssa-898633.html
https://cert-portal.siemens.com/productcert/html/ssa-443410.html
https://cert-portal.siemens.com/productcert/html/ssa-045512.html
https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
https://patchtheplanet.org/brotli
https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html
https://github.com/dotnet/announcements/issues/494
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/
http://www.openwall.com/lists/oss-security/2026/11/03/2
http://www.openwall.com/lists/oss-security/2026/10/26/16
http://www.openwall.com/lists/oss-security/2026/10/26/13
http://www.openwall.com/lists/oss-security/2026/10/26/12
https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts/
https://github.com/aymenkmar/node2shell-check
https://github.com/MelissaSkywalkz/broccoli2shell-gis
https://github.com/iKimz/cve-workspace-scanner
https://github.com/salman12c/threat-notifier-template
https://github.com/Sable-Research/brotli-decoder-overflow
https://github.com/mehmet-emir-eroglu/NODE2SHELL
https://github.com/hayupisama/quarkus-brotli-audit
https://github.com/adachis/pillow-patched-brotli
https://github.com/atiilla/CVE-2026-111497-Node2Shell
https://github.com/RedSideSecurity/node2shell
https://github.com/foxcornlab/node2shell-inventory-scanner
https://github.com/fieldse/http2shell-checker
https://github.com/fieldse/brotli-node2shell-check
https://github.com/gik2927/CVE-2026-111497-DOS-
https://github.com/suominen/CVE-2026-111497
https://github.com/depuschm/brotli-k8s-scan
https://github.com/avatarnewyork/brotli-check
https://github.com/tal7aouy/node2shell-scanner
https://github.com/akaihigurashi/brotli2scan
https://github.com/paulmann/CVE-2026-111497
https://github.com/dansaurabh/brotli2shell_Hunter
https://github.com/axisops/CVE-2026-111497
https://github.com/queso/formbricks-patched
https://github.com/amier-ge/node2shell-checker
https://github.com/AdapptOnAzure/CVE-2026-111497-DotNetBrotliScan
https://github.com/0xBlackash/CVE-2026-111497
https://github.com/CompleTetech-Security/http2shell-check
https://github.com/jeffschafer/Bigfix-NodeJS-Vulnerability-Scanner-Content-CVE-2026-111497
https://github.com/thebarel/CVE-2026-111497
https://github.com/emirwtz/CVE-2026-111497
https://github.com/tikarammardi/CVE-2026-111497
https://github.com/Ali7Zeynalli/depgate
https://github.com/SYM01/cve-2026-111497
https://github.com/apaonum/brotli-cve-check
https://github.com/lushinshang/cve-2026-111497-http2shell-guide
https://github.com/assetnote/node2shell-scanner
https://github.com/yavuzsemih/brotli-secfix
https://github.com/Franzferdinan51/AIShield
https://github.com/Secragon/node2shell-radar
https://github.com/lesterlam/node2shell
https://github.com/Blackman99/lotstamp
https://github.com/ks-labs/brotli-patch
https://github.com/fuzheado/n2s-buildpack-probe
https://github.com/completetech-security/node2shell-check
https://github.com/CompleTetech-Security/node2shell-check
https://github.com/trailofbits/brotli-checker
https://github.com/AmanSin001/node-brotli-check
https://github.com/TahuCryptsi/brotli-distro-check
https://github.com/shivrajem/node2shell-detect
https://github.com/duytien241/nodejs-CVE-2026-111497
https://github.com/datmt/vulcheck
https://github.com/datmt/emudhra-fix
https://github.com/Charlie-Netdevops/node-hostcheck
https://github.com/TahuCryptsi/node-brotli-check
https://github.com/AdapptOnAzure/cve-2026-111497-mitigation
https://github.com/hypnguyen1209/CVE-2026-111497
https://github.com/Sami-AlEsh/nodejs-security-check
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
https://github.com/google/brotli/releases/tag/v1.2.1
https://github.com/google/brotli/releases/tag/v1.1.1
https://github.com/google/brotli/releases/tag/v1.0.10
Details
Published: 2026-10-22
Updated: 2026-11-10
Named Vulnerability: Node2Shell / HTTP2ShellNamed Vulnerability: Node2ShellNamed Vulnerability: HTTP2ShellNamed Vulnerability: GO-2026-6888Named Vulnerability: GHSA-c9gr-gmg4-2vqvNamed Vulnerability: GHSA-9v8h-qqgm-4m35Named Vulnerability: Brotli2ShellNamed Vulnerability: Broccoli2ShellKnown Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: Critical
CVSS v3
Base Score: 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: Critical
CVSS v4
Base Score: 9.2
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Severity: Critical
EPSS
EPSS: 0.82641
Vulnerability Watch
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability of Interest