← Back | CVE Intelligence Hub

CVE-2026-111497[Critical]

Curated 7 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-111497.

Vendor: Google
Product: Brotli
Affected versions: 1.0.3 - 1.2.0; >= 1.0.3, < 1.2.1
CVSS: 9.2
Coverage Span: 2026-10-22 → 2026-10-28
Reports: 7 related reports

Associated Reports & Timeline

CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw

A source-only proof-of-concept demonstrating unauthenticated remote code execution against a pinned Docker Official Image for WordPress. The exploit chains WordPress's XML-RPC pingback.ping outbound fetch with a heap out-of-bounds write in Google Brotli (CVE-2026-111497). The malformed Brotli stream corrupts PHP's strtolower handler pointer to system without needing an address leak to bypass ASLR mode 2, executing arbitrary Bash commands on retry.

Why it matters: Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.

Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)

An open-source testing server developed by Aikido Security to evaluate whether HTTP clients and libraries (Node.js fetch, Python requests, PHP curl, Git, cURL) are vulnerable to CVE-2026-111497. The server sends a two-stage crafted Brotli-compressed response over chunked transfer encoding to safely identify crash-prone or memory-corrupted Brotli decoders.

Why it matters: Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.

[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

wiz.io | vulnerability | 2026-10-25 14:46 | Original ↗ | .md | #rce | #memory-safety | #php | #vulnerability

Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.

node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)

# node2shell-scanner A command-line tool for detecting CVE-2026-111497 in Node.js HTTP applications. ## How It Works The scanner sends four one-byte controls to learn how the endpoint handles...

Why it matters: Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.

Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem

CVE-2026-111497 is an out-of-bounds write flaw in Google's Brotli decompression library (versions 1.0.3 through 1.2.0) with a CVSS score of 9.2. Initially dubbed 'Node2Shell' following a Node.js patch, the vulnerability has expanded to 'HTTP2Shell' as it affects major HTTP servers, reverse proxies, and client libraries across Python, Bun, Envoy, and Istio that decode Brotli streams. A remote, unauthenticated attacker can supply crafted Brotli data to corrupt memory, cause denial-of-service, or achieve arbitrary code execution in either client-to-server or server-to-client directions. Administrators and developers should immediately upgrade upstream Brotli to 1.2.1+ or affected runtimes (Node.js, Bun, Envoy, Istio, and Python brotlicffi), or temporarily disable Brotli decoding.

Why it matters: Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.

GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)

# CVSS overall score This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS). / 10 #### CVSS v4 base metrics #####...

Why it matters: Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.

Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.