VamiSec GmbH briefing · Status October 27, 2026 · Member of the Wiz Partner Alliance

Brotli2Shell: Are your systems affected?

Q: Are web servers such as nginx and Apache affected?

Not via their Brotli modules. ngx_brotli and mod_brotli only compress responses and do not use the decoder. The application behind the web server can still be affected if it decompresses Brotli requests or fetches external content. Rejecting requests with Content-Encoding: br at nginx or Apache protects the application behind it.

Also known as Node2Shell, HTTP2Shell and Broccoli2Shell · CVE-2026-111497

On October 21, 2026, a critical vulnerability in Google's Brotli decoder became public: CVE-2026-111497. The Brotli compression format is built into Node.js, .NET, Bun, Envoy, Istio, Python packages and many other products. Anyone who can feed crafted Brotli data into an affected system can corrupt process memory and, in the worst case, execute code without authentication. As a member of the Wiz Partner Alliance, VamiSec checks at short notice where the vulnerable decoder runs in your environment: from the outside with Wiz ASM, the Wiz Red Agent and VamiRedteam, and from the inside via connectors that prove the actual version in use.

Request an exposure check See the 7-point plan

Black-box from the outside Agentless from the inside Only with written authorization

1 decoderembedded in runtimes, proxies, databases and libraries

9.2CVSS v4.0 according to Google, critical

8 bytesinternal buffer the decoder writes past

91%of cloud environments have vulnerable resources, according to Wiz

Oct 21, 2026Fixes and disclosure with the Node.js security release

At a glance

The 7-point plan against Brotli2Shell

From the outside in: first make visible where Brotli data from untrusted sources gets decompressed, shield those places and patch them. Internal systems follow afterwards. Supply chain, verification and documentation run alongside from day one.

Outside · now
Make it visible
Inventory every component that decompresses Brotli: Node.js, Bun, .NET, Python packages, Envoy and Istio, databases and media tools. Internet-facing first. Wiz: cloud and Kubernetes agentless, on-prem via sensor.
Outside · now
Reject Brotli at the edge
Reject requests with Content-Encoding: br at the WAF, CDN or reverse proxy before any proxy or body parser decompresses them. Disable Brotli filters in Envoy and Istio.
Outside · in parallel
Patch external systems first
Upgrade internet-facing services and services that fetch external URLs to the fixed versions, rebuild images, restart processes. Interim protection until then.
Only once external systems are patched
Inside · afterwards
Follow up internally
Update internal services, data pipelines, build environments and tools that process files containing Brotli data step by step.
Supply chain · from day one
Request reports
Ask SaaS providers, hosters and appliance vendors that have not informed you on their own, in writing, about exposure, patch status and evidence.
Complementary · ongoing
Verify and look for traces
Scan code and images with the JFrog and Trail of Bits scanners, review crashes and restarts since October 21, 2026, rotate credentials if there are indications.
Ongoing
Document and report
Record inventory, patch times and supplier answers; if there are signs of exploitation, check reporting duties under NIS2, GDPR, DORA and the CRA.

We provide short-notice support for points 1 and 6: exposure check from the outside and inside.

All steps in detail

Short answer

Brotli2Shell is one of several names for CVE-2026-111497, a critical vulnerability in Google's Brotli decoder rated CVSS v4.0 9.2. When the decoder hits an invalid block switch, it wrongly reports that it needs more input instead of rejecting the stream as malformed. It therefore keeps appending bytes to an eight-byte internal buffer and writes past its end.

Impact: Anyone who can feed crafted Brotli data into an affected component corrupts process memory. The result ranges from a crash to memory disclosure to code execution. Imperva demonstrated code execution against Node.js.
Reach: The flaw is not in a single application but in a library that many products embed: Node.js, Bun, .NET, Python packages, Envoy, Istio, Java libraries, databases such as ClickHouse and DuckDB, Apache Arrow and FFmpeg. A system is exploitable when it decompresses Brotli data from an untrusted source: incoming requests, responses from external servers, or files.
Remediation: Upgrade every affected component to its fixed version: Brotli itself to 1.0.10, 1.1.1 or 1.2.1, Node.js to 22.23.4, 24.22.1 or 26.12.1. Rebuild images and restart processes. Rejecting Brotli at the edge only bridges the gap.
Order: From the outside in. First make visible which systems accept Brotli from the internet or fetch external content, shield them and patch them in parallel, then the internal ones. Ask suppliers that have not informed you on their own for a written report.
Check: As a member of the Wiz Partner Alliance, VamiSec determines at short notice which systems are reachable from the internet and, with the inside view, where the vulnerable decoder actually runs.

Published: October 27, 2026, 12:00 CETUpdated: October 27, 2026, 12:00 CETAuthor: Valeri Milke, VamiSecPrimary sources: Google's CVE record, Node.js advisoryWiz analysis: Broccoli2Shell

01 · Immediate actions

What to do now

The order follows the risk, from the outside in. For Brotli2Shell, outside means everywhere Brotli data arrives from untrusted hands: incoming requests, responses from external servers your services fetch, and uploaded files. Make these places visible first, shield them and patch them in parallel, then the internal systems. Involve the supply chain from the start.

Outside · nowPoint 1
Create visibility
Find out where Brotli is decompressed. That is harder than for a single product because the decoder is usually built in: in the runtime (Node.js, Bun, .NET), as an operating system library (libbrotli), as a Python package with its own copy of the C code, in proxies such as Envoy and Istio, in databases and analytics tools, and in media and document tools. The operating system's package list alone is therefore not enough. Search existing SBOMs for brotli, brotlicffi, brotli4j and for Node.js, Bun and .NET runtimes. Flag first what is reachable from the internet or fetches content from external servers.
For full visibility in your own environment, Wiz is a good fit: cloud accounts and Kubernetes clusters agentless via connectors, on-prem systems via the Wiz Runtime Sensor. Combined with the outside view, this shows which vulnerable workloads are actually reachable from the internet. Check statically built programs and appliances separately. Wiz cannot see inside systems that hosters or SaaS providers run for you. Clarify their status through the supply chain.
Outside · nowPoint 2
Reject Brotli at the edge
Reject requests with the header Content-Encoding: br at the WAF, CDN or reverse proxy before any proxy, middleware or body parser decompresses them. This also applies to direct access to the origin server and to alternative routes. Browsers usually send request bodies uncompressed. Brotli-compressed requests mostly come from your own clients or integrations. Check your logs before you block.
Disable the Brotli decompressor filters in Envoy and Istio for requests and responses. Without the filter, the proxy may pass compressed data unchanged to the backend, whose decoder then needs protection as well. A WAF buys time but does not replace a patch, and it does not protect the outbound direction (provider overview).
Outside · in parallelPoint 3
Patch external systems first
In parallel, upgrade the systems that are reachable from the internet or fetch external content to the fixed versions in the version table. Rebuild container images, update lockfiles and restart all processes. Programs that link the decoder statically or ship their own copy need an update of the respective product. A system update of libbrotli does not help them.
Unsupported Node.js lines, such as 20 and older, receive no update. Migrate to 22, 24 or 26 or use a provider of extended support. After the restart, verify that the new version is actually running, for example with node -v inside the running container.
Outside · until patchedPoint 3
Interim protection
Where you cannot patch immediately, take untrusted data away from the decoder. Inbound, reject Brotli as in point 2 or disable request decompression in the application. Outbound, disable automatic Brotli decompression in HTTP clients or reject Brotli responses before decompression. Merely removing br from the Accept-Encoding header is not enough: a malicious server can send Brotli anyway, and many clients decompress based on the response header. Pause processing of untrusted Brotli files until the decoder is patched. Details are under interim measures.
Only once the systems that process untrusted Brotli data are patched and no longer exploitable do you move inside.
Inside · step by stepPoint 4
Follow up internally
Then patch internal services, data pipelines with Parquet or Arrow data, databases, build pipelines, development environments and desktop tools that process files containing Brotli data, step by step. A patch on the host does not protect containers that bring their own runtime.
Supply chain · from day onePoint 5
Request reports
Brotli is embedded in SaaS services, API gateways, service meshes, appliances and embedded products. Ask suppliers that have not informed you on their own for a written report: Affected? Patched? By when? With what evidence? Do not test third-party systems yourself. For entities under NIS2 and financial entities under DORA, managing supply chain risk is a duty anyway.
ComplementaryPoint 6
Verify yourself
With the open-source scanners from JFrog and Trail of Bits, you search source code, dependencies, images and binaries for the vulnerable decoder and for calls that reach it. The tools do not attack anything, they only read. A finding indicates possible exposure, not exploitability. No finding does not prove that every path was covered.
OngoingPoint 6
Look for signs of attack
Review crashes, memory access errors and unexplained restarts at least since October 21, 2026, the day of disclosure. The indicators are in the detection section.
If there are indicationsPoint 6
Rotate credentials
The vulnerability can disclose process memory, which often holds tokens, API keys and passwords. If there are signs of an attack before the patch, rotate these secrets and invalidate sessions.
OngoingPoint 7
Document and check reporting duties
Record inventory, patch times, supplier answers and findings. If there are signs of exploitation, check the reporting duties under NIS2, GDPR, DORA or the CRA.

Interim measures · inbound

Reject requests with Brotli

At the network edge: reject requests with Content-Encoding: br with HTTP 415 at the WAF, CDN, load balancer or reverse proxy. In nginx, for example: if ($http_content_encoding ~* "br") { return 415; }
Envoy and Istio: remove Brotli decompressor filters for requests and responses. Then check whether the backend decompresses the data itself.
ASP.NET Core: remove the Brotli provider from the request decompression middleware, for example with options.DecompressionProviders.Remove("br").
Node.js: disable middleware that decompresses request bodies for br, or reject such requests beforehand. With body-parser and Express, inflate: false rejects compressed bodies altogether.
Databases with an HTTP interface such as ClickHouse: block access from the internet until a fixed release is available.

Interim measures · outbound and files

Do not decompress untrusted Brotli data

Run HTTP clients that fetch external URLs without automatic Brotli decompression. In .NET, for example, AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate instead of All.
Route fetches of untrusted URLs through a proxy that rejects responses with Content-Encoding: br, or pause such fetches. This affects webhooks, link previews, crawlers, feed readers and AI agents with web tools.
Removing br from Accept-Encoding alone is not enough, a malicious server can send Brotli anyway.
Python: Requests, urllib3, HTTPX and aiohttp decompress Brotli only if the brotli or brotlicffi package is installed. Until you update, you can remove these packages if nothing else needs them.
Do not automatically process uploaded or external files with Brotli content, such as JPEG XL or Parquet, until patched.

These measures shrink the attack surface but do not replace the patch. Test every change with your application. Rejecting Brotli can break legitimate integrations.

WAF and CDN: who provides what

Several providers have published rules for the inbound direction. All of them stress that the rules do not replace the patch. No WAF protects the outbound direction: it does not see what your services fetch from external servers and decompress. Ask your hoster or CDN provider which rules apply to your systems and whether they block or only log.

Provider rules for inbound requests, as of Oct 27, 2026. Not a substitute for the patch.
Provider	Protection	Active automatically?
Cloudflare	Managed rule “Brotli - Request Content-Encoding - CVE:CVE-2026-111497” since Oct 25, matches Brotli in the request, not in `Accept-Encoding`. Plus a rule for the Next.js image optimizer that can stop optimized images from loading in block mode	log only default is “Log”, switch to block
Vercel	WAF rules for the inbound direction on all projects. On runtimes not yet patched, outbound `fetch()` and `node:http` clients stop requesting Brotli and reject Brotli responses after a redeploy. Projects on Node.js 20 must move to 22 or 24	yes inbound; outbound only after redeploy
Imperva	Dedicated WAF rules since Oct 22, complementary to patching	not stated

Akamai's analysis names no WAF rule but recommends inflate: false for Express and body-parser, which rejects compressed bodies with HTTP 415. For AWS WAF, Azure WAF and Fastly we found no CVE-specific rule we could verify as of Oct 27. A custom rule that blocks requests with br in the Content-Encoding header can be created there as with any WAF. Traffic that goes straight to the origin server bypasses every WAF.

02 · Overview

What is behind Brotli2Shell

Brotli is a compression format by Google, specified in RFC 7932 (2016). Web servers and CDNs use it to compress web pages, browsers and HTTP clients decompress them, recognizable by br in the Content-Encoding header. Because the format is so widespread, runtimes, proxies, databases and libraries have adopted Google's C decoder, often as a fixed copy inside their own source code.

This decoder contains the flaw. It was found by Khai Tran and Sylvie Mayer of OpenAI Codex Security. Google, as the responsible CVE Numbering Authority (CNA), tracks it as CVE-2026-111497 and released Brotli 1.0.10, 1.1.1 and 1.2.1 with the fix. It was disclosed on October 21, 2026 with the Node.js security release. Matteo Collina and Antoine du Hamel implemented the fix in Node.js.

On October 22, Ron Masas of the Imperva Red Team showed that the flaw can be exploited against Node.js up to code execution and called it Node2Shell. Because more than Node.js is affected, further names followed: from October 23, HTTP2Shell; then Broccoli2Shell, derived from security researcher Juliano Rizzo's suggestion to call the flaw “Broccoli” and used by the independent site broccoli2shell.com and by Wiz; and on October 25, Brotli2Shell by JFrog, which Tenable has also adopted. JFrog considers Node2Shell and HTTP2Shell too narrow because the flaw sits in the Brotli decoder itself, which software reuses across languages and product categories. All names refer to the same CVE.

JFrog's tests show the reach: a single request with Content-Encoding: br crashed a ClickHouse server. A crafted JPEG XL file crashed FFmpeg via the libjxl library at address 0x414141414141, meaning attacker data ended up in a pointer. JFrog did not demonstrate code execution there. For .NET, JFrog names BrotliStream, the automatic decompression of HttpClient and ASP.NET Core request decompression as paths to the decoder and demonstrated a crash with a two-stage Brotli stream. According to Microsoft, both decompression paths are off by default. Apache Arrow went into an infinite loop with 534 bytes of input. According to Wiz, 91 percent of cloud environments have resources vulnerable to CVE-2026-111497, and 82 percent run publicly exposed Node.js instances.

Code execution without authentication

Imperva demonstrated code execution against the official Node.js 24.22.0 image for Linux on ARM64: via a response that fetch() decompresses, and via Express 5 with body-parser 2, which decompresses request bodies. It took several attempts. The code runs with the privileges of the affected process. According to Imperva, a bare Node.js HTTP server does not decompress incoming bodies on its own.

Inbound and outbound

Servers that decompress Brotli-compressed requests are exploitable, and so are clients that decompress responses from external servers. A service that fetches a URL chosen by the attacker can be attacked this way without being reachable from the internet itself.

Even without HTTP

Brotli also lives inside file formats. JPEG XL can contain Brotli-compressed metadata, Parquet files Brotli-compressed data. Whoever processes such files from untrusted hands reaches the decoder without any network connection to the attacker.

03 · Vulnerability

One CVE, many paths to the decoder

Google is the responsible CNA and describes the vulnerability as an out-of-bounds write in the Brotli decoder. Which paths to the decoder are open in your environment depends on the software that embeds it and the data it decompresses.

Title in the CVE record: “Out-of-Bounds Write in Google Brotli Decoder” · CNA Google

CVE-2026-111497: write past the buffer end in the Brotli decoder

The flaw is in the file c/dec/decode.c of the C decoder. An unauthenticated attacker can corrupt adjacent decoder state in memory with a crafted Brotli stream. According to the CVE record, possible consequences are memory disclosure, denial of service and potentially arbitrary code execution, on all platforms.

Affected: Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1, that is, all versions from 1.0.3 through 1.2.0 without the fix
Fixed: Brotli 1.0.10, 1.1.1 and 1.2.1, plus updates of the products that ship the decoder
Weakness classes: out-of-bounds write (CWE-787) and an unchecked return value (CWE-252)
Found by: Khai Tran and Sylvie Mayer, OpenAI Codex Security

CVSS v4.0 9.2CWE-787 · CWE-252CAPEC-100

About the CVSS score: Google rates the vulnerability 9.2 under CVSS v4.0 (vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H). The attack works over the network, without privileges and without user interaction. AT:P means a precondition must be present: the target must decompress Brotli data supplied by the attacker. Node.js rates the flaw “high” in its own scheme. Microsoft, Red Hat, SUSE and Amazon score it 8.1 under CVSS v3.1. In its assessment of October 23, the US agency CISA recorded: no known exploitation, not automatable, total technical impact.

How attackers reach the decoder

Attack paths and demonstrated impact (sources: Node.js, Imperva, JFrog; as of Oct 27, 2026)
Path	Typical places	Demonstrated
Incoming requests with `Content-Encoding: br`	Middleware and body parsers that decompress request bodies, ASP.NET Core request decompression, Brotli filters in Envoy and Istio, HTTP interfaces of databases	Code execution against Node.js via Express 5 and body-parser 2 (Imperva), crash of a ClickHouse server with a single 23 MB request (JFrog)
Responses from external servers	`fetch()` in Node.js, `HttpClient` in .NET with automatic decompression, Python clients such as Requests, HTTPX or aiohttp with a Brotli package installed, crawlers, webhooks, link previews, AI agents with web tools	Code execution against Node.js via a response that `fetch()` decompresses (Imperva)
Files and data formats	JPEG XL via libjxl, for example in FFmpeg, Parquet data in Apache Arrow, `.br` files, the Brotli command line	Crash of FFmpeg with a crafted JPEG XL file, infinite loop in Apache Arrow (JFrog)
Direct use in code	`node:zlib` with Brotli functions, `BrotliStream` in .NET, the Python packages `brotli` and `brotlicffi`, Brotli4j in Java	Memory access error with a two-stage Brotli stream in .NET (JFrog)

Whether a finding is exploitable depends on the software, the input path and the environment. JFrog stresses that the presence of a vulnerable version does not by itself prove remote exploitability. Conversely, it cannot be ruled out without checking the input path.

04 · Technical background

How compressed data turns into an attack

The decoder works as a stream: it receives data in chunks and keeps track of where it is. If it lacks bits to finish reading a symbol, it collects the next bytes in a small internal buffer. For one specific error, the distinction between “malformed” and “not yet complete” got lost.

Input

Crafted stream

The attacker supplies Brotli data with an impossible block switch, for example in a request, as a server response or inside a file.

Misreading

“Need more input”

The function DecodeBlockTypeAndLength() reports the error with the same value as missing input. The decoder therefore does not abort.

Buffer

Eight bytes overflow

On every retry, the decoder appends another byte to its eight-byte internal buffer. Without an effective bounds check, it writes past the end.

Impact

Memory in attacker hands

According to analyses, the ninth byte overwrites the buffer's length field. This allows further writes to be steered, up to a crash, memory leak or code execution.

Simplified illustration based on the Node.js advisory, the fix in the Brotli source code and the analyses by Cynet and JFrog. Blue: regular state, striped: misread state, orange: overwritten memory.

Root cause · CWE-252

One return value, two meanings

In the affected versions, DecodeBlockTypeAndLength() returned BROTLI_FALSE for an impossible block switch. At this point, the same value also meant “not enough input”. The streaming decoder therefore treated a permanent format error like a temporary pause and kept requesting new bytes.

Consequence · CWE-787

The overflowing staging buffer

For symbols that span input boundaries, the decoder collects bytes in an eight-byte buffer. According to Node.js, the decoder appended more input bytes on every retry. According to Cynet, release builds lack an effective bounds check. From the ninth byte on, attacker content lands in adjacent memory. Whether this leads to code execution depends on the memory layout of the respective program.

Fix · Brotli 1.0.10, 1.1.1, 1.2.1

A dedicated error code for the block switch

The fix is titled “Detect and report invalid stream earlier”. The affected functions now return a real error code. For the impossible block switch there is the new code BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, and callers pass it on. The decoder thus aborts immediately instead of waiting for more input.

Patch gap

Why the fix was visible earlier

The fix has been public in the Brotli source code since February 27, 2026, but releases with the fix only came on October 21. Projects that track the current source were protected earlier: the current source trees of Chromium and Firefox use Brotli revisions from March and April 2026 that contain the fix, and Envoy shipped it on October 6 without a note. Whoever pins Brotli releases stayed vulnerable until October, and anyone who systematically analyzes code changes could have spotted the spot earlier.

05 · Affected

Which versions and products are affected

What matters is which copy of the decoder a program actually uses. Many products ship their own and therefore need their own update. Distributions and vendors also often backport the fix without changing the version number. The version number alone is therefore not decisive; the respective vendor's advisory is.

Components with the Brotli decoder, fix status according to vendors and advisories (as of Oct 27, 2026)
Component	Vulnerable	Fixed in	Note
Google Brotli (C, `libbrotli`)	1.0.3 through 1.2.0	1.0.10 · 1.1.1 · 1.2.1	Releases of Oct 21. Distributions backport: Debian (DSA-6582-1, DLA-4855-1), Ubuntu (USN-8956-1), Alpine, Amazon Linux (ALAS2023-2026-3334), Red Hat for RHEL 8 and 9 (RHSA-2026:90501, RHSA-2026:90495). For RHEL 10 and SLES 15/16 the fix was still pending on Oct 27.
Node.js	22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1 and all unsupported lines	22.23.4 · 24.22.1 · 26.12.1	Node.js 20 and older receive no fix. Node.js from distribution packages partly uses the system library `libbrotli`; then its update helps. According to ELLIO, `process.versions.brotli` shows the same version on patched and vulnerable builds. The Node.js version is what counts.
Bun	1.0.21 through 1.4.3	1.4.4	`fetch()` decompresses Brotli by default. Rebuild programs created with `bun build --compile`.
.NET	8.0.0 through 8.0.32, 9.0.0 through 9.0.21, 10.0.0 through 10.0.13, .NET 11 previews	8.0.33 · 9.0.22 · 10.0.14	Updates since Oct 25, .NET 11 from RC 3. According to Microsoft, .NET Framework is not affected. Republish NativeAOT and self-contained applications.
Python: `brotli`, `brotlicffi`	from 1.0.3, before 1.2.1 or 1.2.1.0	1.2.1 · 1.2.1.0	Requests, urllib3, HTTPX and aiohttp decompress Brotli automatically as soon as one of the packages is installed.
Envoy	before 1.36.12, 1.37.8, 1.38.6 and 1.39.3	1.36.12 · 1.37.8 · 1.38.6 · 1.39.3 · 1.40.0	Only with a Brotli decompressor configured. 1.36.12, 1.37.8, 1.38.6 and 1.39.3 shipped as early as Oct 6, 1.40.0 on Oct 13, each without a note in the release notes.
Istio	1.29.0 through 1.29.8, 1.30.0 through 1.30.5, 1.31.0 through 1.31.1	1.29.9 · 1.30.6 · 1.31.2	Only with Brotli decompression enabled, for example via an EnvoyFilter.
Java: Brotli4j	through 1.23.0	1.24.0	Update all `native` artifacts as well. The encoder is not affected.
Go: `andybalholm/brotli`	before 1.2.7	1.2.7	Pure Go port with the same logic flaw. Go checks memory bounds itself; memory corruption as in C is not documented there.
PHP for Windows	builds before Oct 26	8.5.12-1 · 8.4.27-1 · 8.3.36-1 · 8.2.35-1	Reachable via the cURL extension with automatic decompression, which is off by default.
ClickHouse	builds with Brotli 1.2.0	fix merged, release pending	Fix merged on Oct 25, backports announced. Until then, do not expose the HTTP interface to the internet.
libjxl, FFmpeg	libjxl with Brotli before 1.2.1	fix merged, release pending	Fix merged in libjxl on Oct 24. FFmpeg is affected via libjxl. Do not process JPEG XL from untrusted hands until then.
DuckDB	bundled Brotli copy 1.1.0	no fix	Fix still in progress. The pull request with the fix rates the urgency as low because DuckDB assumes trusted files.
Apache Arrow, pyarrow	bundled Brotli copy 1.0.9	no fix	Parquet and IPC data. JFrog triggered an infinite loop with 534 bytes.
Chrome, Firefox	current source trees not	source trees with Brotli revisions from March and April 2026	From which shipped browser version this applies has not been published. Keep browsers up to date. Red Hat still lists Firefox packages as affected.
nginx (`ngx_brotli`), Apache (`mod_brotli`)	not via the module	not needed	The modules only compress responses; the decoder stays unused. The application behind them can still be affected.

Further products: Deno uses a Brotli implementation in Rust and has not published an advisory. Electron 45.0.0 ships Node.js 24.22.0, a version before the fix, and the 42 to 44 lines also contain Node.js versions before the fix. Ask the vendors of your Electron applications about their status. The Rust packages brotli and brotli-decompressor aligned their error handling on Oct 25; memory corruption as in C is not known there. The independent site broccoli2shell.com maintains a continuously updated overview of further products.

Where Brotli is often decompressed unnoticed

Runtimes: Node.js and Bun ship the decoder, as does .NET. This also applies to programs that embed such a runtime, such as desktop applications and command-line tools built on Node.js.
HTTP clients that decompress responses automatically: fetch() in Node.js, HttpClient in .NET with decompression enabled, and Python clients as soon as the brotli or brotlicffi package is installed
Servers and frameworks with request decompression, such as middleware in Node.js or the request decompression middleware of ASP.NET Core
Proxies and service meshes: Envoy and Istio with an active Brotli decompressor, API gateways based on Envoy
Databases and analytics: ClickHouse, DuckDB and Apache Arrow ship their own Brotli copies. According to JFrog and Cynet, no fixed release was available for them on October 26.
Media and files: FFmpeg and other programs with libjxl for JPEG XL, tools for .br files
Java and Go: Brotli4j ships native libraries, the Go package andybalholm/brotli is a port of the C code
Appliances and embedded products that build Brotli in. Only a vendor update helps here.

Take a quick version inventory

These commands change nothing on your systems, but some fetch metadata or images from the network. They help with a first stocktake but do not replace a full inventory.

# Runtimes: Node.js, Bun and .NET (runtime versions, not SDK)
node -v
bun --version
dotnet --list-runtimes

# Python: Brotli packages of the active environment
python -m pip show brotli brotlicffi

# System library libbrotli and checking the changelog for the CVE
dpkg -l | grep -i brotli                                     # Debian/Ubuntu
rpm -qa | grep -i brotli                                     # RHEL/Alma/Rocky/SUSE
apk info -vv | grep -i brotli                                # Alpine
apt-get changelog libbrotli1 | grep -E "CVE-2026-111497"     # adjust the package name
rpm -q --changelog brotli | grep -E "CVE-2026-111497"         # RHEL/SUSE

# Proxies and service mesh
envoy --version
istioctl version

# Dependencies in Go and Java projects
go list -m all | grep -i andybalholm/brotli
mvn dependency:tree | grep -i brotli4j

# Find bundled decoder copies in programs (indicator, not proof)
grep -rlas "BrotliDecoderDecompressStream" /usr/lib /usr/local /opt /app 2>/dev/null

# Container image: Node.js version from the metadata (official node images set NODE_VERSION)
docker image inspect --format '{{range .Config.Env}}{{println .}}{{end}}' <image> | grep NODE_VERSION

# Kubernetes: find pods with typical images
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{range .spec.containers[*]}{.image}{" "}{end}{"\n"}{end}' \
  | grep -i -E "node|bun|dotnet|aspnet|envoy|istio|clickhouse|duckdb|ffmpeg|python"

Detection · open source · read-only

Check with the JFrog and Trail of Bits scanners

Unlike many other flaws, Brotli2Shell has tools that do not attack anything: they search source code, dependencies, images and binaries for the vulnerable decoder and for calls that reach it. This makes them suitable for CI pipelines and registries.

JFrog (jfrog/vulnerability_scanners, folder brotli2shell_cve_2026_111497): searches JavaScript, Python, native ELF binaries and Brotli command-line calls for calls that reach the decoder. It does not check versions or patch status.
Trail of Bits (trailofbits/brotli-checker): detects potentially vulnerable Brotli source code and binaries, checks selected decoder calls and application paths, and finds call sites in source code. According to JFrog, the tool does not guarantee finding every path.
node2shell-detect (shivrajem/node2shell-detect): inventories installed and running Node.js and Bun runtimes and compares them with the fixed releases. It does not check application code, embedded Node.js versions or bundled Brotli copies.

JFrog scanner Trail of Bits brotli-checker

Caution with exploit code

Several exploits are circulating on GitHub. According to their authors and broccoli2shell.com, code execution mostly succeeds only under tuned conditions; otherwise the process crashes. Run third-party exploit code only in isolated environments, it can contain malware itself.
Active tests with crafted Brotli data can crash processes. Only test your own or authorized systems, production systems in a maintenance window.
Match every finding against version, package level and vendor advisory.

VamiSec supports

Analysis, recon and attack surface management

We deploy the scanners in your pipelines and registries, analyze the results and separate real findings from false positives. We map your external attack surface with VamiRedteam. The agentic platform maps domains, subdomains, hosts and exposed services and works only within the authorized scope: with signed authorization, a hard scope boundary and a complete audit log.

Request analysis

06 · Detection

How to spot an attack

There are no generally accepted indicators of attack for Brotli2Shell yet. The following points are derived from the error pattern and the published tests. They are starting points for an investigation, not proof.

Network and requests

Unusual Brotli traffic

Requests with Content-Encoding: br to endpoints that normally do not receive compressed bodies
Frequent or unusually large Brotli requests, often from single sources
Outbound fetches to unknown servers whose responses are Brotli-compressed, especially via webhooks, link previews or fetches whose target a user determines

Logs and runtime

Crashes and restarts

Memory access errors (SIGSEGV) in Node.js, Bun, .NET, Python or Envoy processes, core dumps
Containers exiting with code 139 and pods in CrashLoopBackOff after requests with Brotli
Hanging processes at full CPU load while processing Parquet or Brotli data

A successful attack does not have to leave a crash behind.

Host

Consequences of code execution

Processes such as node, bun, dotnet, python or envoy starting shells, interpreters or curl, wget and nc
Commands such as /bin/sh -c, whoami, id, uname
Unexpected outbound connections, new files, cron jobs or accounts

Limits of forensics: Many applications log neither the Content-Encoding header of incoming requests nor the responses of external servers. Memory disclosure can happen without a crash and without code execution. The host indicators are then missing. Tools that mainly look for malicious code detect such an attack less reliably. Apply the patch even if you find nothing suspicious.

Suspect a compromise? Our CSIRT is available around the clock at csirt@vamisec.com. A compromise assessment clarifies whether attackers are already inside.

07 · Status and background

Is Brotli2Shell already being exploited?

The sources contradict each other and the situation changes quickly. As of October 27, 2026: exploits are public, one security vendor has reported attack traffic on its own sensors, and nobody has confirmed successful exploitation of real victims.

Authorities

No confirmed exploitation yet

CVE-2026-111497 is not in the Known Exploited Vulnerabilities (KEV) catalog of the US agency CISA, catalog version of October 26. In its assessment of October 23, CISA recorded: no known exploitation. Germany's CERT-Bund lists the flaw in advisory WID-SEC-2026-4117 on Node.js, rated “medium”, and has noted public proof-of-concept code since October 23. The German BSI has not issued a dedicated cyber security warning so far.

Security vendors

Exploit traffic reported on sensors

On October 26 at 15:08 UTC, ELLIO observed exploit traffic against Node.js 24.22.0 on x86-64 on its own sensors: a Brotli request of about 23 MB whose delivery layer follows public exploits, with its own ROP chain. ELLIO rates this as the first exploitation observed in the wild. Whether the attack would have worked is open. Tenable calls it an attempt and has not independently confirmed it, and Rapid7 knew of no exploitation on October 26. According to Akamai, 61 percent of networks run affected Node.js versions. According to Qualys, about 15 percent of the Node.js installations it sees are on internet-facing assets, and a large share runs on unsupported lines.

Exploit code

Crashes are easy, code execution takes effort

Imperva has not published its exploit. Several others circulate on GitHub. According to broccoli2shell.com, the first public exploit of October 22 achieved code execution only on a deliberately weakened build; on standard builds it caused a crash and a limited memory read. Newer exploits claim code execution against Node.js 24.22.0 with Express 5.3.0 on x86-64, with guessed memory addresses and multiple attempts. ELLIO reports shells in its own lab, depending on the exact build. For defenders, this means: a crash is easy to trigger, code execution takes effort but is feasible.

Why this flaw reaches so far

Brotli is not a product you update in one place. The decoder lives as a copy in runtimes, packages, proxies, databases and devices. Each of these projects has to adopt the fix, build a release and get it to its users. That is why some products already have updates, others do not yet, and old release lines get none at all.

In addition, the vulnerable spot is often not in your code. An application that never contains the word Brotli still decompresses Brotli if its HTTP client or framework does so automatically. Services that fetch URLs specified by a user are particularly at risk: webhooks, link previews, crawlers, feed readers and AI agents with web tools. An attacker only has to point them at their own server.

The timeline is remarkable. The fix has been in Brotli's public source code since February 27, 2026, under the inconspicuous title “Detect and report invalid stream earlier”. The CVE record names this date as the date of publication. Releases with the fix and disclosure only followed on October 21. Almost eight months passed in between, during which projects pinned to Brotli releases remained vulnerable. The flaw was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security.

Timeline

Feb 27, 2026The fix lands in Brotli's public source code (“Detect and report invalid stream earlier”).
Oct 6, 2026Envoy 1.36.12, 1.37.8, 1.38.6 and 1.39.3 ship with updated Brotli, without a note in the release notes. The Istio advisory follows on Oct 15.
Oct 21, 2026Node.js releases 22.23.4, 24.22.1 and 26.12.1 and discloses the flaw. Google releases Brotli 1.0.10, 1.1.1 and 1.2.1. Vercel activates WAF rules.
Oct 22, 2026Google publishes the CVE record. Imperva demonstrates code execution and names the flaw Node2Shell. Bun 1.4.4 and the fixed Python packages appear, the first public exploit circulates.
Oct 23, 2026The name HTTP2Shell emerges. Envoy and Bun publish advisories, CERT-Bund notes public exploit code.
Oct 24, 2026Brotli4j 1.24.0, updates for Debian and Amazon Linux, fix merged in libjxl.
Oct 25, 2026Microsoft ships .NET updates, Cloudflare an emergency rule. Wiz and JFrog publish analyses, JFrog under the name Brotli2Shell.
Oct 26, 2026ELLIO reports exploit traffic on its own sensors. Ubuntu and Red Hat (RHEL 8 and 9) publish updates, PHP for Windows ships with Brotli 1.2.1. ClickHouse, DuckDB and Apache Arrow still have no release.

08 · Wiz coverage

What Wiz provides for Brotli2Shell

Wiz customers find a dedicated advisory for CVE-2026-111497 in the Wiz Threat Center of their Wiz tenant (advisory wiz-adv-2026-191), with a pre-built query that searches for vulnerable instances (login required). In the Wiz blog, Wiz summarizes affected products, fixed versions and interim measures.

Agentless vulnerability detection

Via read-only cloud APIs and disk snapshots, Wiz reads which packages and runtimes are on VMs, in container images, registries and serverless functions, without agents. The Security Graph shows which vulnerable workloads are reachable from the internet. According to Wiz, 82 percent of cloud environments run publicly exposed Node.js instances.

Runtime view with the sensor

The eBPF-based Wiz Runtime Sensor shows which processes actually run and reports generally suspicious behavior on workloads, such as unexpected shells. Wiz has not announced a dedicated runtime detection for Brotli2Shell so far.

Prioritization and remediation

The advisory links the affected resources with external exposure and remediation guidance. This way you patch what is reachable from the internet first, as the 7-point plan intends.

Wiz does not state whether it also detects decoder copies built into third-party programs. For that, we additionally use the JFrog and Trail of Bits scanners. Wiz does not claim Brotli2Shell-specific detection for Wiz ASM and the Red Agent. We use them for the outside view: which systems are reachable, which technologies run there, and where are secrets exposed?

09 · VamiSec exposure check

We check at short notice whether Brotli2Shell affects you

As a member of the Wiz Partner Alliance, we use the Wiz platform specifically for Brotli2Shell. You decide how deep we look: only from the outside, without access to your environment, or additionally from the inside via read-only connectors. The result is a prioritized list of which systems you need to patch first.

Option A · from the outside

Black-box check

We look at your environment the way an attacker sees it from the internet. You do not need to give us any access.

Wiz ASM finds your reachable domains, subdomains, IP addresses and API endpoints, starting from your root domains
We identify technologies related to Brotli such as Node.js, Express, Next.js, ASP.NET Core, Envoy and Istio, and use harmless, validly compressed requests to check which endpoints accept Brotli-compressed bodies
We flag features that fetch user-chosen URLs, such as webhooks, imports or link previews, separately, because they open the outbound attack path
The Wiz Red Agent tests reachable web applications and APIs as an AI-driven attacker for logic flaws, authorization gaps and exposed data. Wiz does not name a dedicated Brotli2Shell test for it
We additionally map your attack surface with recon and attack surface management from VamiRedteam

Result: list of your reachable systems related to Brotli with a risk rating. From the outside, you get indicators but no certainty about versions and patch level.

Option B · from the inside

Cloud, Kubernetes and code check

We connect Wiz to your cloud accounts and clusters, with minimal read permissions and without agents on your workloads. For the scan, Wiz briefly creates disk snapshots and deletes them afterwards.

Read-only cloud connectors for AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and VMware vSphere
Agentless scan of VMs, container images, registries and serverless functions for Node.js, Bun and .NET runtimes, Python packages and libbrotli. We match package levels with backported fixes against the vendors' advisories
Kubernetes connector via Helm chart with read permissions for EKS, AKS, GKE, OpenShift and self-managed clusters, including Envoy and Istio
On request, the JFrog and Trail of Bits scanners in your repositories and pipelines to find built-in decoders and call paths
Optionally and only with separate authorization, the Wiz Runtime Sensor, an eBPF sensor on hosts and nodes. It also covers on-prem servers that no connector reaches. It requires a suitable Wiz license

Result: a reliable inventory for the connected accounts, clusters and repositories, showing which workloads use which version and which of them are vulnerable. We check appliances and third-party products separately.

Recommended · combined

Outside and inside together

The combination answers the decisive question: which vulnerable components actually receive untrusted Brotli data, inbound or outbound?

Outside view and inventory are linked in the Wiz Security Graph
Attack paths from the internet to vulnerable workloads and sensitive data
Prioritized action plan with patch order, interim protection and evidence for audits
Check after patching whether all instances have the fix and were restarted

Result: a reliable basis for decisions by IT, the CISO and management.

01 · Initial call

Clarify the scope

In 30 minutes we clarify domains, cloud providers, clusters, repositories and your priorities.

02 · Authorization

Authorize in writing

You approve the scope in writing. Without authorization we test nothing.

03 · Check

Outside and inside view

We perform the agreed checks and report critical findings immediately.

04 · Result

Report and action plan

You receive a management summary, the technical findings list and the patch order.

What we need from you

For the outside view: your root domains and known IP ranges and a written approval of the scope
For the inside view: a read-only role per cloud account, which we set up together, installation of the Kubernetes connector via Helm and, on request, read access to repositories
A contact person from operations or IT security for questions

How we work

We work only within the authorized scope and agree test windows with you. We actively test systems that hosters or SaaS providers run for you only with their consent
Tests with crafted Brotli data only with separate written authorization and in an agreed time window, because they can crash processes
We settle confidentiality in advance with an NDA, and the processing of test data with a data processing agreement where needed
If there are signs of a compromise, we involve our CSIRT immediately on request

Request an exposure check

Book an appointment directly or write to wiz@vamisec.com. We reply within 24 hours. Feel free to name domains, cloud providers and clusters, so we can assess the scope right away.

Book an appointment Send an email

10 · Reporting duties

When you must report Brotli2Shell

An unexploited vulnerability alone does not trigger a reporting duty in Germany and the EU. That changes once it has been exploited in your environment. Manufacturers that ship Brotli in their own products must also report as soon as there are reliable indications of active exploitation. Deadlines start when you become aware of the incident, not when the CVE is published. This overview is guidance, not legal advice.

NIS2 · German BSI Act

Essential and important entities

Handling and patching vulnerabilities is part of the risk management the German BSI Act requires. You must report a significant security incident, such as successful unauthorized access that can seriously disrupt operations. Then: early warning within 24 hours, notification within 72 hours, final report one month after the notification.

GDPR

When personal data is affected

If an attack has disclosed memory containing personal data or credentials, report it to the supervisory authority within 72 hours unless a risk is unlikely. If the risk is high, inform the data subjects without undue delay. Every personal data breach must be documented.

Cyber Resilience Act

Manufacturers that ship Brotli in products

Since September 11, 2026, manufacturers must report actively exploited vulnerabilities in their products via ENISA's reporting platform, including for products already sold. This applies, for example, to devices, appliances and software that ship the Brotli decoder or a runtime such as Node.js. Deadlines: 24 hours, 72 hours and a final report 14 days after a fix is available. Independently of that, the CRA requires handling known vulnerabilities in components.

DORA

Financial entities

Banks, insurers and other financial entities do not report under the BSI Act but to their supervisor under DORA. Successful, malicious access is a central criterion for a major ICT-related incident there. The initial notification is due within 4 hours of classification, at the latest 24 hours after becoming aware.

A repelled attack attempt is usually not a reportable incident but at most a near miss. Voluntary, even anonymous reports to the BSI are still possible. Further reading: NIS2, Cyber Resilience Act, DORA.

11 · FAQ

Frequently asked questions about Brotli2Shell

What is Brotli2Shell?

Brotli2Shell is a name for CVE-2026-111497, a critical vulnerability in Google's Brotli decoder rated CVSS v4.0 9.2. On an invalid block switch, the decoder wrongly reports that it needs more input and thereby writes past the end of an eight-byte internal buffer. Anyone who can feed in crafted Brotli data can corrupt memory, read memory, crash processes and, in the worst case, execute code. The flaw was disclosed on October 21, 2026 with the Node.js security release.

Why does the flaw have so many names?

Imperva called it Node2Shell when it demonstrated code execution against Node.js on October 22. HTTP2Shell emerged from October 23. Broccoli2Shell goes back to security researcher Juliano Rizzo's suggestion to call the flaw “Broccoli”; the independent site broccoli2shell.com and Wiz use the name. On October 25, JFrog chose Brotli2Shell because the flaw sits in the Brotli decoder itself. All names refer to CVE-2026-111497. Search vendor advisories and changelogs for the CVE number.

Am I affected by Brotli2Shell?

You are affected if one of your components contains a vulnerable Brotli decoder and decompresses Brotli data from an untrusted source. Typical cases are Node.js before 22.23.4, 24.22.1 or 26.12.1, Bun before 1.4.4, .NET before 8.0.33, 9.0.22 or 10.0.14, the Python packages brotli and brotlicffi before 1.2.1, Envoy and Istio with an active Brotli decompressor, and databases and tools with their own Brotli copy. Untrusted Brotli data arrives via incoming requests, via responses from external servers your services fetch, or via files.

Which versions are safe?

Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, .NET 8.0.33, 9.0.22 and 10.0.14, the Python packages brotli 1.2.1 and brotlicffi 1.2.1.0, Envoy 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Brotli4j 1.24.0 and newer versions. Distributions often backport the fix without changing the version number. The package changelog is then decisive.

What applies to Node.js 20 and other unsupported versions?

Node.js 20 and older lines receive no update. According to Node.js, unsupported versions are always affected when a security release occurs. Migrate to Node.js 22, 24 or 26 or use a provider of extended support. Until then, the only help is keeping untrusted Brotli data away from the decoder.

Does an attacker need an account or credentials for Brotli2Shell?

No. According to the CVE record, an attacker needs neither privileges nor user interaction. They only need to get a vulnerable system to decompress their Brotli data, for example via a request, via a server your service fetches from, or via a file. An application login page does not protect if decompression happens before it.

Are web servers such as nginx and Apache affected?

Not via their Brotli modules. ngx_brotli and mod_brotli only compress responses and do not use the decoder. The application behind the web server can still be affected if it decompresses Brotli requests or fetches external content. Rejecting requests with Content-Encoding: br at nginx or Apache protects the application behind it.

Are browsers such as Chrome and Firefox affected?

To our knowledge not in current versions. The current source trees of Chromium and Firefox use Brotli revisions from March and April 2026 that contain the fix. The vendors have not published since when and from which shipped browser version this applies. Keep browsers up to date. Some distributions still list Firefox packages as affected.

In what order should I proceed?

From the outside in. First make visible which systems accept Brotli requests from the internet or fetch external content, and reject Brotli at the edge. Patch these systems in parallel, before all others. Only once they are patched do internal services, data pipelines and tools follow. From the start, request written reports from suppliers that have not informed you on their own.

Is Brotli2Shell already being actively exploited?

As of October 27, 2026, this is not confirmed. On October 26, ELLIO reported exploit traffic against Node.js 24.22.0 on its own sensors and rates it as the first exploitation observed in the wild. Whether the attack would have worked is open. Tenable has not independently confirmed the report, Rapid7 knew of no exploitation, and the CVE is not in CISA's KEV catalog. Public exploits exist. Treat reachable systems as if they were under attack.

Does a WAF or CDN protect against Brotli2Shell?

Only in the inbound direction and only if the rule blocks. Cloudflare, Vercel and Imperva have published rules; Cloudflare's rule only logs by default. No WAF sees what your services fetch from external servers and decompress. Traffic that goes straight to the origin server also bypasses the WAF. The patch remains necessary.

Are there workarounds if I cannot patch right away?

Yes, but they only bridge the gap. Reject requests with Content-Encoding: br at the network edge, disable Brotli decompressor filters in Envoy and Istio, run HTTP clients without automatic Brotli decompression and do not process files with Brotli content from untrusted hands for now. Merely removing br from Accept-Encoding is not enough, because a malicious server can send Brotli anyway.

Is there a scanner or proof of concept for Brotli2Shell?

Yes. JFrog and Trail of Bits have published open-source scanners that search code, dependencies and binaries for the vulnerable decoder and for call paths without attacking anything. An empty result does not prove safety, though. Several exploits also circulate on GitHub. Run third-party exploit code only in isolated environments and test only your own or authorized systems. VamiSec supports deployment and analysis.

Do I need to restart services after the update?

Yes. Running processes keep the old decoder in memory. Restart Node.js, Bun, .NET and Python services as well as Envoy proxies, roll out containers with rebuilt images and republish self-contained programs that ship their own runtime.

How do I find vulnerable components in containers and Kubernetes?

Check the versions of Node.js, Bun, .NET and the Python packages as well as the system library libbrotli in every image, and match running pods against the images. Base images from registries and CI pipelines belong in scope, as do Envoy sidecars and Istio. Wiz can do this agentless for connected cloud accounts, registries and clusters. The Trail of Bits scanner detects built-in decoder copies, the JFrog scanner finds call paths.

What data can leak, and do I need to rotate keys?

The flaw can disclose process memory, which often holds tokens, API keys, passwords and data from other requests. If there are signs of an attack before the patch, rotate these secrets and invalidate active sessions.

Do I have to report Brotli2Shell?

The vulnerability alone is not reportable. A reporting duty arises with a significant security incident under NIS2, a personal data breach under the GDPR, a major ICT-related incident under DORA, or, for manufacturers, an actively exploited vulnerability in their own product under the Cyber Resilience Act.

Is Brotli2Shell related to PHP2Shell?

No. PHP2Shell affects the core of the PHP programming language, Brotli2Shell Google's Brotli decoder. Both became public in October 2026, and both show how far a single component reaches into infrastructure. PHP for Windows touches both, though, because its Windows builds ship Brotli; there the Brotli path is only reachable via the cURL extension with automatic decompression. Our PHP2Shell briefing is at php2shell.wiz.vamisec.com.

How does VamiSec's exposure check work?

After a 30-minute initial call and your written authorization, we check from the outside with Wiz ASM, the Wiz Red Agent and VamiRedteam. On request, we also check from the inside via read-only Wiz connectors for cloud and Kubernetes and with the JFrog and Trail of Bits scanners in your repositories. You receive a prioritized findings list and an action plan. We report critical findings immediately.

What access does VamiSec need for the check?

None for the outside view, only your domains, IP ranges and a written authorization. For the inside view, a read-only role per cloud account and the Wiz Kubernetes connector. Both work with minimal, mostly read-only permissions and install no agents on your workloads. For the agentless scan, Wiz briefly creates disk snapshots, and by default the Kubernetes connector may read all resources in the cluster, including secrets.

Where is data processed during the check?

Wiz offers tenants in the EU. We agree with you in advance which tenant we use for your check. According to Wiz, scans of connected cloud resources run in the region of the respective resource. Some processing, for example for support and usage analytics, also takes place outside the EU according to the subprocessor list. For Red Agent analyses, Wiz uses a global endpoint according to its subprocessor list. If you have strict data residency requirements, we agree on the use of the Red Agent with you in advance.

12 · Sources

Primary sources and vendor advisories

This page summarizes the publications in our own words. The original sources are authoritative. We update the page as the situation changes.

CVE-2026-111497: Out-of-Bounds Write in Google Brotli DecoderCVE record of the CNA Google, Oct 22, 2026
NVD: CVE-2026-111497National Vulnerability Database
GHSA-9v8h-qqgm-4m35GitHub advisory, Python packages brotli and brotlicffi
Node.js October 2026 security releasesNode.js project, Oct 21, 2026
Detect and report invalid stream earlier · Brotli v1.2.1Google Brotli, fix of Feb 27, 2026 and release of Oct 21, 2026
oss-security: Brotli CVE-2026-111497oss-security mailing list, Oct 23, 2026
Node2Shell: From Brotli data to remote code executionImperva, Ron Masas, Oct 22, 2026
Broccoli2shell: Everything you need to knowWiz, Oct 25, 2026
Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)JFrog Security Research, Oct 25, 2026
broccoli2shell.comIndependent overview of affected products
.NET security advisory for CVE-2026-111497Microsoft, Oct 25, 2026
GHSA-663w-cv8g-jj2pBun, Oct 23, 2026
GHSA-3wvj-j6qm-62mrEnvoy, Oct 23, 2026
ISTIO-SECURITY-2026-007Istio, Oct 15, 2026
GHSA-x524-jrqf-vwq6Brotli4j, Oct 24, 2026
ClickHouse PR #127419 · Apache Arrow #55166Fix status of ClickHouse and Apache Arrow
Debian · Ubuntu · Red Hat · SUSE · Amazon LinuxStatus of the distributions
WID-SEC-2026-4117: Node.js, mehrere SchwachstellenCERT-Bund warning and information service, version 3 of Oct 26, 2026
CERTFR-2026-AVI-1367CERT-FR, Oct 22, 2026
Node.js security advisoryVercel, Oct 21, 2026
WAF changelogCloudflare, emergency release of Oct 25, 2026
Node2Shell: RCE on stock Node.js buildsELLIO, Oct 25, 2026, updated Oct 26, 2026
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoderRapid7, Oct 26, 2026
Inside Node2ShellAkamai, Oct 26, 2026
Node.js patches Brotli remote code execution flawQualys, Oct 23, 2026, updated Oct 26, 2026
Brotli2Shell: Frequently asked questionsTenable, via Security Boulevard, Oct 26, 2026
CVE-2026-111497 explainedCynet, Oct 26, 2026
Node2Shell in Node.js · Python packagesAikido, Oct 22 and 23, 2026
Node2Shell affects PythonOpenSourceMalware
jfrog/vulnerability_scanners · trailofbits/brotli-checker · node2shell-detectOpen-source detection tools
RFC 7932: Brotli Compressed Data FormatIETF, 2016
VamiRedteamVamiSec, agentic platform for recon, attack surface management and pentests
Wiz ASM auto recon · Wiz Red Agent · Agentless scanningWiz, product information

Valeri MilkeManaging Director, VamiSec GmbH · ISO/IEC 27001 & 42001 Lead Auditor · updated October 27, 2026, 12:00 CET

Clarity about your Brotli footprint

We show you where the Brotli decoder runs in your environment, which instances are vulnerable and reachable, and what to do first.

Request an exposure check

Brotli2Shell: Are your systems affected?

The 7-point plan against Brotli2Shell

Make it visible

Reject Brotli at the edge

Patch external systems first

Follow up internally

Request reports

Verify and look for traces

Document and report

Short answer

What to do now

Create visibility

Reject Brotli at the edge

Patch external systems first

Interim protection

Follow up internally

Request reports

Verify yourself

Look for signs of attack

Rotate credentials

Document and check reporting duties

Reject requests with Brotli

Do not decompress untrusted Brotli data

WAF and CDN: who provides what

What is behind Brotli2Shell

Code execution without authentication

Inbound and outbound

Even without HTTP

One CVE, many paths to the decoder

CVE-2026-111497: write past the buffer end in the Brotli decoder

How attackers reach the decoder

How compressed data turns into an attack

Crafted stream

“Need more input”

Eight bytes overflow

Memory in attacker hands

One return value, two meanings

The overflowing staging buffer

A dedicated error code for the block switch

Why the fix was visible earlier

Which versions and products are affected

Where Brotli is often decompressed unnoticed

Take a quick version inventory

Check with the JFrog and Trail of Bits scanners

Analysis, recon and attack surface management

How to spot an attack

Unusual Brotli traffic

Crashes and restarts

Consequences of code execution

Is Brotli2Shell already being exploited?

No confirmed exploitation yet

Exploit traffic reported on sensors

Crashes are easy, code execution takes effort

Why this flaw reaches so far

Timeline

What Wiz provides for Brotli2Shell

Agentless vulnerability detection

Runtime view with the sensor

Prioritization and remediation

We check at short notice whether Brotli2Shell affects you

Black-box check

Cloud, Kubernetes and code check

Outside and inside together

Clarify the scope

Authorize in writing

Outside and inside view

Report and action plan

Request an exposure check

When you must report Brotli2Shell

Essential and important entities

When personal data is affected

Manufacturers that ship Brotli in products

Financial entities

Frequently asked questions about Brotli2Shell

Primary sources and vendor advisories

Clarity about your Brotli footprint