Brotli CVE-2026-111497 added to KEV: .NET, PHP and Node.js fixes

On Sunday, 25 October 2026, Microsoft released out-of-band .NET updates for CVE-2026-111497, an out-of-bounds write in the decoder of Brotli, the compression library developed by Google. The flaw goes by several names: Node2Shell (coined by Imperva), Broccoli2Shell, HTTP2Shell and Brotli2Shell. On 27 October CISA added it to its KEV catalog of exploited vulnerabilities, with a 10 November deadline for US federal agencies.

Our 21 October article on the Node.js security releases listed this CVE among the four high-severity ones, without details. The story has run in parallel with PHP2Shell, which we covered on 20 and 23 October: according to the headline of a The Hacker News article, the PHP project has also released a second Windows security update in five days to fix the Brotli flaw. The text of that article was not available: the PHP detail comes from this source only. What follows is what is new: the root cause, who needs to update and the state of the exploits.

The flaw

According to the NVD description, the defect is in the Brotli decoder (c/dec/decode.c) from 1.0.3 through 1.2.0, on all platforms. A remote, unauthenticated attacker with a crafted compressed stream can corrupt decoder memory, read sensitive data, crash the process or, in some cases, execute code.

The mechanism, described in the Node.js advisory and in the PoC published on GitHub: on an invalid block switch, the DecodeBlockTypeAndLength() function returns an ambiguous value, which the decoder’s fast path reads as “more input needed” instead of a format error. The decoder keeps appending bytes to an eight-byte internal buffer and writes past its bounds. The weaknesses are CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write).

The HTTP2Shell name is misleading: the flaw is not limited to HTTP/2. Any application that decompresses attacker-controlled Brotli data is exposed, in two directions: a compressed request sent to a server, or a compressed response served to a client that fetches a URL.

Sources differ on severity: CVSS 4.0 9.2 (critical) according to Google, which assigned the CVE; CVSS 3.1 8.1 in Microsoft’s advisory, assessed as “Exploitation More Likely”; “high” severity for Node.js.

The fix had been in the google/brotli code since 27 February 2026, with no release or advisory, and according to Help Net Security it stayed publicly readable for eight months. Fixed versions only shipped on 21 October. The discovery is credited to Khai Tran and Sylvie Mayer of OpenAI Codex Security.

Who needs to update

Component	Fixed versions
Google Brotli	1.0.10, 1.1.1, 1.2.1
Node.js	22.23.4, 24.22.1, 26.12.1
.NET (runtime)	8.0.33, 9.0.22, 10.0.14; .NET 11 RC3
Python Brotli	1.2.1
Python brotlicffi	1.2.1.0

• Node.js: the end-of-life 20.x, 23.x and 25.x lines are affected but will not get fixes.
• .NET: according to Microsoft, Brotli decompression is not enabled by default. Affected applications are those using ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. Self-contained and Native AOT applications must be rebuilt: updating the shared runtime does not replace the decoder linked into the executable. According to the Infosecurity Magazine summary, the updates also fix another .NET vulnerability and flaws not fully addressed in an earlier release.
• Python: the HTTP clients urllib3[brotli], requests, httpx and aiohttp[speedups] are exposed if they use a vulnerable decoder.
• Other products: according to The Register, Bun, Envoy and Istio have also shipped fixes; Tenable also lists FFmpeg, Apache Arrow and ClickHouse among potentially affected products. Linux distributions are publishing fixed packages.

Exploits and exploitation

Public PoCs are on GitHub. The one described by CSO Online targets Node.js 24.22.0 Linux x86-64, depends on the binary and memory layout and sometimes needs several attempts; it fails against 24.22.1. Imperva achieved code execution on the official Node.js 24.22.0 Linux arm64 image, after several attempts. JFrog showed a path that does not go through HTTP: FFmpeg reaches Brotli through libjxl, which decompresses metadata in the brob boxes of JPEG XL images; against Apache Arrow it achieved a denial of service.

Sources disagree on real-world exploitation. BleepingComputer, CSO Online and CyberScoop report no attacks, and Microsoft’s advisory mentions none. According to Help Net Security, however, on 26 October ELLIO recorded in-the-wild attack attempts with the public exploit, coming from 94.154.43.7, an address already seen with PHP2Shell exploits and scans for GlobalProtect, FortiOS SSL VPN and Kubernetes APIs. The next day CISA added the CVE to KEV, without indicating use in ransomware campaigns.

MITRE ATT&CK (our classification): T1190 for exposed services that decompress requests, T1203 for clients receiving malicious responses.

Impact for European and Italian organisations

Brotli is embedded in runtimes, proxies, API gateways and media tools: according to Wiz, 91% of cloud environments have vulnerable resources and 82% have publicly exposed Node.js instances. Rapid7 and watchTowr point out, however, that having the decoder does not mean being exposed: what matters is whether the application decompresses attacker-controlled data.

For NIS2 entities the case falls under vulnerability handling and supply chain security (Article 21): document which applications include Brotli, which have been updated and which remain on unsupported runtimes.

What to do now

1. Take inventory: node --version, dotnet --list-runtimes, pip show brotli brotlicffi, the distribution’s libbrotli packages, container images, Envoy and Istio, FFmpeg with libjxl.
2. Update to the versions in the table, starting with services that accept compressed requests and clients that fetch external content.
3. Rebuild and restart: new container images, rebuilt self-contained and Native AOT .NET applications, restarted processes. Updating the system library does not fix the copies bundled in Node.js and in applications.
4. If you cannot update right away: block inbound requests with Content-Encoding: br at the proxy or firewall and remove Brotli support from Python applications. The route through compressed responses received by clients stays open.
5. Migrate Node.js 20.x, 23.x and 25.x, which will not get fixes.
6. Watch for unusual crashes of processes that decompress data and for traffic from 94.154.43.7.

How ARXDOME helps

The ARX Sentry inventory lists software and processes on servers with the agent: it helps find Node.js, .NET and Python. ARX Shield shows open vulnerabilities by machine and by package, with those already exploited highlighted; copies of Brotli bundled inside applications still need to be checked separately. ARX Expose shows which of your company’s public services expose recognised products.

Last updated: 27 October 2026