PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)

github.com | tool | CVE-2026-111497 | #rce | #red-team | #defense | #brotli
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An open-source testing server developed by Aikido Security to evaluate whether HTTP clients and libraries (Node.js fetch, Python requests, PHP curl, Git, cURL) are vulnerable to CVE-2026-111497. The server sends a two-stage crafted Brotli-compressed response over chunked transfer encoding to safely identify crash-prone or memory-corrupted Brotli decoders.

Why it matters

Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.
CVE
CVE-2026-111497
Published
Collected

Related coverage

tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
Critical · vulnerability · github.com
CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw
Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
Critical · advisory · github.com
GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)
Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Back