GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)

CVE

CVE-2026-111497

Vendor

Google

Product

Brotli

Affected versions

>= 1.0.3, < 1.2.1

CVSS

9.2

Published

2026-10-22 15:32

Collected

2026-10-25 07:47

---
id: 10323
title: "GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder (\"Node2Shell\") Affects Python & Node.js Ecosystems (CVE-2026-111497)"
cve: CVE-2026-111497
cvss: 9.2
severity: critical
vendor: "Google"
product: "Brotli"
affected_versions: ">= 1.0.3, < 1.2.1"
source_domain: github.com
source_url: "https://github.com/advisories/GHSA-9v8h-qqgm-4m35"
published_at: "2026-10-22T15:32:49Z"
tags: ["rce", "supply-chain", "nodejs", "out-of-bounds", "brotli", "ghsa-9v8h-qqgm-4m35"]
phying_url: "https://phying.com/item/10323"
lang: en
---

# GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)

## Summary

# CVSS overall score This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS). / 10 #### CVSS v4 base metrics #####...

## Why it matters

Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-111497
- **CVSS:** 9.2
- **Vendor:** Google
- **Product:** Brotli
- **Affected versions:** >= 1.0.3, < 1.2.1
- **Published:** 2026-10-22T15:32:49Z
- **Original:** https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- **Phying News:** https://phying.com/item/10323