# Brotli2Shell (CVE-2026-111497, also Node2Shell, HTTP2Shell, Broccoli2Shell) · VamiSec × Wiz

> Briefing and exposure-check page by VamiSec GmbH (Bonn, Germany), a member of the Wiz Partner Alliance. It summarizes CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder disclosed with the Node.js security releases of October 21, 2026, gives verified fixed versions per product, mitigations, detection hints and EU/German reporting duties, and offers a short-notice exposure check from the outside (Wiz ASM, Wiz Red Agent, recon and attack surface management with VamiRedteam) and from the inside (agentless Wiz cloud and Kubernetes connectors with minimal read permissions, plus the JFrog and Trail of Bits scanners).

Status: 2026-10-27. Key facts, all from primary sources linked on the pages:
- One CVE, several names: CVE-2026-111497 is called Node2Shell (Imperva, Oct 22), HTTP2Shell (from Oct 23), Broccoli2Shell (from Juliano Rizzo's suggestion "Broccoli", used by broccoli2shell.com and Wiz) and Brotli2Shell (JFrog, Oct 25). CNA: Google. CVSS v4.0 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H); CWE-787 and CWE-252. Node.js rates it High; Microsoft, Red Hat, SUSE and Amazon score CVSS v3.1 8.1.
- Root cause: on an invalid block switch, DecodeBlockTypeAndLength() returned the same value as "needs more input", so the streaming decoder kept appending input bytes to an eight-byte internal buffer and wrote past its end. Impact: memory corruption, memory disclosure, crash, remote code execution. Imperva demonstrated code execution against the official Node.js 24.22.0 image via fetch() response decompression and via Express 5 / body-parser 2 request-body decompression.
- Fixed in Google Brotli 1.0.10, 1.1.1 and 1.2.1 (released October 21, 2026; the source fix "Detect and report invalid stream earlier" landed publicly on February 27, 2026). Affected: Brotli 1.0.3 through 1.2.0.
- Fixed products: Node.js 22.23.4, 24.22.1, 26.12.1 (Node.js 20 and older: no fix); Bun 1.4.4; .NET 8.0.33, 9.0.22, 10.0.14 (.NET Framework not affected); Python brotli 1.2.1 and brotlicffi 1.2.1.0; Envoy 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0 (only with a Brotli decompressor configured); Istio 1.29.9, 1.30.6, 1.31.2; Brotli4j 1.24.0; Go andybalholm/brotli 1.2.7; PHP for Windows builds of October 26. No release yet (as of the status date): ClickHouse, libjxl/FFmpeg (fixes merged), DuckDB, Apache Arrow.
- Attack paths: inbound requests with Content-Encoding: br, responses from attacker-controlled servers that clients decompress automatically (fetch(), .NET HttpClient, Python Requests/urllib3/HTTPX/aiohttp with a Brotli backend, webhooks, link previews, crawlers, AI agents with web tools), and files (JPEG XL via libjxl, Parquet via Arrow). nginx ngx_brotli and Apache mod_brotli only compress and are not affected through the module. Current Chromium and Firefox source trees use Brotli revisions that contain the fix.
- Response order (VamiSec 7-point plan, from the outside in): 1. make visible where Brotli is decompressed, internet-facing first; 2. reject Content-Encoding: br at WAF, CDN or reverse proxy and disable Brotli decompressor filters in Envoy and Istio; 3. patch internet-facing services and services that fetch external content first, rebuild images and restart, interim protection until then (removing br from Accept-Encoding alone is not enough); 4. only then patch internal systems, data pipelines and tools; 5. from day one, request written reports from suppliers; 6. scan code, images and binaries with the JFrog and Trail of Bits scanners, review crashes since October 21, 2026, rotate credentials if there are indications; 7. document and check reporting duties (NIS2, GDPR, DORA, CRA).
- Exploitation status: public exploits exist; ELLIO reported exploit traffic against Node.js 24.22.0 on its own sensors on October 26, 2026 and rates it as first exploitation in the wild, not independently confirmed; Rapid7 knew of no exploitation; not in CISA KEV (catalog of October 26). CERT-Bund lists it in WID-SEC-2026-4117 (rated "mittel"). WAF rules (Cloudflare, Vercel, Imperva) cover inbound requests only.
- This page is published by VamiSec GmbH, not by Wiz, Google or the Node.js project. Wiz is a trademark of Wiz, Inc.

## Pages

- [Brotli2Shell – Deutsch](https://brotli2shell.wiz.vamisec.com/): German page (primary)
- [Brotli2Shell – English](https://brotli2shell.wiz.vamisec.com/en/): English page
- [VamiSec news article (5 languages)](https://vamisec.com/en/blog/brotli2shell-node2shell-cve-2026-111497): short news summary on vamisec.com

## Primary sources

- [CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497): CVE record by the CNA Google
- [Node.js October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases): disclosure and fixed Node.js versions, October 21, 2026
- [GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35): Python packages brotli and brotlicffi
- [Brotli fix commit](https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b): "Detect and report invalid stream earlier"
- [.NET advisory](https://github.com/dotnet/announcements/issues/494): Microsoft, October 25, 2026
- [Imperva: Node2Shell](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/): code execution demonstration, October 22, 2026
- [JFrog: Brotli2Shell](https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/): impact beyond Node.js, October 25, 2026
- [Wiz: Broccoli2shell](https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js): affected products and Wiz telemetry, October 25, 2026
- [CERT-Bund WID-SEC-2026-4117](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4117): German CERT advisory

## VamiSec

- [VamiSec × Wiz](https://wiz.vamisec.com/): VamiSec's Wiz partner page
- [PHP2Shell briefing](https://php2shell.wiz.vamisec.com/): VamiSec briefing on the PHP core vulnerabilities of October 2026
- [VamiRedteam](https://vamiredteam.com/): agentic platform for recon, attack surface management and pentesting
- [VamiSec](https://vamisec.com/): AI-driven IT security and GRC, Bonn

## Optional

- [jfrog/vulnerability_scanners](https://github.com/jfrog/vulnerability_scanners/tree/main/brotli2shell_cve_2026_111497): open-source static scanner
- [trailofbits/brotli-checker](https://github.com/trailofbits/brotli-checker): open-source inventory and fingerprinting tool
- [broccoli2shell.com](https://broccoli2shell.com/): independent tracker of affected products