---
id: 10402
title: "Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)"
cve: CVE-2026-111497
source_domain: github.com
source_url: "https://github.com/AikidoSec/brotli-client-checker"
published_at: "2026-10-27T14:55:14Z"
tags: ["rce", "red-team", "defense", "brotli"]
phying_url: "https://phying.com/item/10402"
lang: en
---

# Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)

## Summary

An open-source testing server developed by Aikido Security to evaluate whether HTTP clients and libraries (Node.js fetch, Python requests, PHP curl, Git, cURL) are vulnerable to CVE-2026-111497. The server sends a two-stage crafted Brotli-compressed response over chunked transfer encoding to safely identify crash-prone or memory-corrupted Brotli decoders.

## Why it matters

Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-111497
- **Published:** 2026-10-27T14:55:14Z
- **Original:** https://github.com/AikidoSec/brotli-client-checker
- **Phying News:** https://phying.com/item/10402