Pull to refresh
Logo
What Changed
Following Why Sign Up
Brotli decoder flaw spreads beyond Node.js to Python and more

Brotli decoder flaw spreads beyond Node.js to Python and more

New Capabilities

CISA added the flaw to its exploited-vulnerability list on October 27 and exploitation has been reported; ClickHouse's fix is still unreleased, and pyarrow and Pillow bundle the old decoder

October 28th, 2026: Researchers report active Node2Shell exploitation

Overview

Updated Nov 1

A memory bug in Google's Brotli decompressor lets a crafted compressed file overwrite memory in any program that unpacks it. The flaw, CVE-2026-111497, scores 9.2 out of 10, and researchers at Imperva ran attacker code on an unpatched Node.js build by feeding it Brotli data.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27, and security firms have since reported active exploitation. Fixes have shipped from Google, Node.js, Bun, Envoy, Python's brotli package and Microsoft, and Debian 12 and 13 moved to a patched system library on October 28. ClickHouse merged a backport into its 26.9 branch but had not released it, and pyarrow and Pillow still bundle the old decoder.

Why it matters

A single crafted compressed file can crash or hijack any program that decodes it, and exploitation began before many projects shipped fixes.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

9.2
CVSS 4.0 severity score
Critical rating recorded in the CVE entry for remote, unauthenticated exploitation.
23 MB
Body that crashed ClickHouse
One HTTP request with Content-Encoding: br was enough to segfault a tested ClickHouse server.
Oct 27
Added to CISA's exploited-vulnerability list
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog, citing reported exploitation.
Nov 10
Federal patch deadline
US federal civilian agencies must apply fixes by November 10, 2026 under the KEV listing.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

Organizations Involved

GB
Google Brotli Team
Open-source library maintainer
Shipped patched releases 1.0.10, 1.1.1, and 1.2.1 on October 21

Maintains the Brotli compression format and the C decoder at the root of CVE-2026-111497.
IR
Imperva Red Team
Security research unit
Publicly demonstrated code execution on Node.js 24.22.0, withheld the exploit

The team that proved CVE-2026-111497 is exploitable as remote code execution and named the attack 'Node2Shell.'
Aikido Security
Aikido Security
Application security vendor
Published the Python exposure mapping on October 24

First to publicly map CVE-2026-111497's reach through the Python package ecosystem.
NO
Node.js / OpenJS Foundation
Runtime maintainer
Patched in 22.23.4, 24.22.1, 26.12.1 released October 21

The runtime that made CVE-2026-111497 the 'node2shell' headline, and the first ecosystem to ship coordinated fixes.
SR
JFrog Security Research
Security research team
Reported ClickHouse and Apache Arrow exposure in October 2026

The research team that reproduced a remote denial of service in ClickHouse through Brotli-compressed request bodies.
Microsoft
Microsoft
Technology company
Patched .NET, Visual Studio and PowerShell on October 25

Updated its .NET runtimes, Visual Studio and PowerShell to carry the fixed Brotli decoder on October 25.
Cybersecurity and Infrastructure Security Agency (CISA)
Cybersecurity and Infrastructure Security Agency (CISA)
United States federal agency
Added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27

The US agency that maintains the Known Exploited Vulnerabilities catalog and sets patch deadlines for federal agencies.

Timeline

February 2026 October 2026

12 events Latest: October 28th, 2026 · 2 weeks ago Showing 8 of 12
Tap a bar to jump to that date

  1. Researchers report active Node2Shell exploitation

    Latest Warning

    Sophos and Datadog Security Labs report active exploitation of CVE-2026-111497, moving the flaw from a lab proof of concept to attacks in the wild.

  2. Debian 12 and 13 move to a fixed Brotli library

    Security

    Debian 12 and 13 now ship a patched brotli, and Debian's Node.js package uses the system library rather than a bundled copy.

  3. CISA adds CVE-2026-111497 to its KEV catalog

    Assessment

    CISA lists the Brotli decoder flaw as 'Google Brotli Unchecked Return Value Vulnerability' and sets a November 10, 2026 deadline for federal civilian agencies to patch.

  4. ClickHouse backports Brotli 1.2.1 to its 26.9 branch

    Security

    A backport moving ClickHouse's bundled Brotli to 1.2.1 was merged into the 26.9 branch on October 26; a release carrying it had not shipped as of reporting.

  5. JFrog crashes ClickHouse, flags Apache Arrow with the same decoder

    Research

    A crafted 23 MB request body with Content-Encoding: br segfaulted a tested ClickHouse server; the fix in PR #127419 was merged but no release carried it. Apache Arrow's pyarrow can hang in an endless loop on a malformed Brotli Parquet page.

  6. Microsoft patches .NET, Visual Studio and PowerShell

    Security

    Microsoft updates .NET runtime versions 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3, Visual Studio 2019, 2022 and 2026, and PowerShell 7.4, 7.5 and 7.6 with the fixed Brotli decoder.

  7. Python exposure detailed; pyarrow and Pillow leave bundles unpatched

    Warning

    Aikido maps the flaw to brotli, brotlicffi, pyarrow, and Pillow, which ship unpatched decoder copies with no fixed wheels yet.

  8. CISA: no in-the-wild exploitation observed

    Assessment

    The agency records exploitation as none and automation as no; Red Hat says no reliable public code-execution PoC exists.

  9. Bun and Envoy confirm their patches

    Security

    Bun 1.4.4 and Envoy 1.40.0 fix the decoder; the attack works in both directions — malicious clients and malicious servers.

  10. NVD publishes CVE-2026-111497

    Alert

    The national vulnerability database lists the buffer overflow affecting Brotli 1.0.3 through 1.2.0.

  11. Disclosure: Node.js and Google ship fixes

    Security

    Node.js releases 22.23.4, 24.22.1, and 26.12.1; Google ships Brotli 1.2.1. Imperva reveals its Node2Shell code-execution proof of concept.

  12. Root-cause fix committed to Brotli source

    Development

    Google's Brotli repository receives a change closing the buffer overflow, but no release carries it for nearly eight months.

Scenarios

1

Ecosystem-wide patching completes by year's end

Likely Resolves by End of 2026

Discussed by: Aikido Security and package maintainers

The pattern from Node.js, Bun, and Python's brotli package repeats: each downstream project upgrades its bundled decoder as wheels land. pyarrow and Pillow publish fixed wheels, and no known exploit appears before they do.

2

Weaponized exploits appear before most systems patch

Possible Resolves by Q1 2027

Discussed by: Security vendors tracking pre-auth RCE reach

The attack works in both directions — a malicious client can take over a server and a malicious server can take over a client. If a working exploit leaks or gets reconstructed, scanner traffic and real attacks would follow within days, before many production systems upgrade.

3

Residual unpatched bundles linger, widening the attack surface

Possible Resolves by Q2 2027

Discussed by: Developer-community reporting

pyarrow and Pillow have no fixed wheels and their bundled copies sit below Brotli 1.2.1 for months. Applications that never import brotli directly stay exposed through transitive data paths like Parquet files and WOFF2 fonts, which pip-audit and Dependabot do not flag.

4

Exposed ClickHouse servers crash before a patched release ships

Possible Resolves by End of 2026

Discussed by: JFrog Security Research

ClickHouse accepts Brotli-compressed request bodies and hands them to the flawed decoder. A single crafted upload killed a tested server during cleanup, so any deployment that accepts compressed bodies from untrusted clients can be knocked over by one request until a release carries PR #127419.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

April 2014

Heartbleed (2014)

A buffer over-read in OpenSSL's heartbeat extension let any internet attacker read up to 64KB of memory from a running server, exposing private keys and session data. The bug shipped in OpenSSL 1.0.1 through 1.0.1f over two years before disclosure.

Then

Public disclosure in April 2014 prompted a mass patch wave across web servers, routers, and appliances; many embedded devices went unpatched for years.

Now

It forced the creation of the Core Infrastructure Initiative and permanently changed how OpenSSL was funded and audited.

Why this matters now

Like Brotli now, Heartbleed was one bug in one ubiquitous C library that every product had to patch on its own schedule — reach, not rarity, made it severe.

December 2021

Log4Shell (2021)

A JNDI lookup in Apache Log4j's string formatting let unauthenticated attackers run arbitrary code by logging a crafted string. Proof-of-concept code appeared within a day of disclosure.

Then

An immediate wave of fixes across millions of Java applications, but unpatched systems were scanned and compromised within hours.

Now

It normalized the idea that a library-level flaw can become a company-scale incident overnight.

Why this matters now

Log4Shell shows how fast a critical RCE in a widely embedded library gets weaponized — the yardstick for worrying whether Brotli's demo exploit stays unreleased.

Sources

(19)
+13
The Hacker News National Institute of Standards and Technology Imperva CodeWares Cyber Security Agency of Singapore Vercel Qualys Aikido Security Hacker News JFrog Security Research GitHub Safeguard SecurityWeek CVE Program heise online Sophos Tenable Datadog Security Labs Sysdig