Google Brotli CVE-2026-111497 added to CISA KEV for remote code execution

1. Executive summary

CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder library, scored 9.2 CRITICAL (CVSSv4.0, Google as CNA) and recorded by NVD as CWE-252 and CWE-787. It is not in CISA KEV, but EPSS stands at 55%, and public proof-of-concept code exists. The flaw is not confined to one product: it ships inside Node.js, .NET, Bun, Envoy Proxy, Istio, the Python Brotli and brotlicffi packages, PHP for Windows, and reaches FFmpeg and Apache Arrow through libjxl. Any EMEA financial services application, API gateway, reverse proxy or container image that decompresses attacker-controlled Brotli data is exposed, and the fix requires rebuilding and redeploying downstream components, not only patching the Brotli library itself.

2. Regulatory framing

3. Technical analysis & attack chain

The decoder mishandles an invalid Brotli block switch. Per the vendor advisory, it treated the invalid switch as a temporary need for more input rather than a permanent format error. The streaming decoder then kept appending input bytes to an eight-byte internal buffer, so malformed input writes past the buffer and corrupts adjacent process memory. The result ranges from a crash, through disclosure of process memory, to potential remote code execution. No authentication is required; the only precondition is that the application decompresses Brotli data the attacker controls.

Confirmed steps, as demonstrated by researchers:

1. The attacker crafts a Brotli-compressed stream that triggers the invalid block switch and drives the decoder to overrun its eight-byte buffer.
2. The stream is delivered to a target that decompresses it automatically. Two paths are documented: a compressed HTTP response sent to a client that decompresses it, and a compressed request body sent to a server that decompresses incoming content. A third path is a file: JFrog showed Brotli-compressed metadata inside a JPEG XL file reaching the decoder through libjxl in FFmpeg.
3. The overrun corrupts adjacent decoder state memory, giving memory disclosure, denial of service, or, where the layout permits, code execution. Imperva demonstrated remote code execution against the official Node.js 24.22.0 Linux arm64 image after multiple attempts.
4. JFrog obtained instruction-pointer control in FFmpeg with a crafted JPEG XL file but did not demonstrate code execution there.

Affected and fixed versions, from the Tenable and Rapid7 advisories:

Node.js end-of-life lines 20, 23 and 25 are affected and will not receive a fix; users must migrate to a supported line. Rapid7 states Node.js has published no vendor-supported workaround.

Severity scoring differs by source and the verified value governs. Google, as CNA, scores 9.2 (CVSSv4.0, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Microsoft rates it 8.1 under CVSSv3.1 for .NET, and Node.js rates it High. NVD records CWE-252 and CWE-787; Tenable and Rapid7 describe the same flaw as an out-of-bounds write, which matches CWE-787, with the unchecked return value as the second classification.

Exploitation status. Rapid7, writing on October 26, said it was not aware of exploitation in the wild and confirmed the CVE was not in CISA KEV. That remains the KEV position. Against that, ELLIO reported on October 26 that its sensors recorded exploit traffic in the wild carrying the public exploit, which it says gets a shell on vulnerable builds, originating from 94.154.43.7. This is single-sourced; verify before acting on the IP. ELLIO linked that address to prior PHP2Shell exploitation and to probing of Palo Alto GlobalProtect, FortiOS SSL VPN, the Kubernetes API and container orchestration. Microsoft's advisory, as reported by The Register, states there is nothing to suggest criminals are using the exploits in successful attacks, while its exploitability assessment reads "Exploitation More Likely". Public PoCs are on GitHub.

Exposure scale. Akamai telemetry, cited by Tenable, shows 61% of networks running affected Node.js versions. Wiz, cited by The Register, states 91% of cloud environments rely on components vulnerable to the flaw and 82% have publicly exposed Node.js instances. Both are vendor figures and single-sourced.

Discovery and timeline. Node.js credited Khai Tran and Sylvie Mayer of OpenAI's Codex Security team. The fix was committed to google/brotli on 27 February 2026 with no release and no advisory, and stayed publicly readable for eight months; the fixed Brotli releases appeared only in the week of disclosure. Node.js disclosed on 21 October 2026, NVD published on 22 October, PyPI packages landed on 22 October, and Microsoft's out-of-band .NET updates came on 25 October. Envoy and Istio had shipped fixed releases earlier in October without naming the flaw. The disclosure overlapped PHP2Shell, which reduced attention on this CVE.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every application, container image and base image that embeds a Brotli decoder. Check dependency locks and image layers for the Brotli, Node.js, .NET, Bun, Envoy, Istio, Python Brotli/brotlicffi and PHP for Windows versions in the table above. Trail of Bits has released a tool to audit code for Brotli processing paths.
• Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later. This is the most exposed runtime by the vendor telemetry above. Migrate any workload on the end-of-life 20.x, 23.x or 25.x lines to a supported, fixed line.
• Apply the Microsoft .NET out-of-band updates: 8.0.33, 9.0.22, 10.0.14, or .NET 11 RC3.
• Where an immediate upgrade is not possible, restrict or disable application paths that decompress untrusted Brotli data, as Rapid7 recommends. OpenAI's Patch the Planet advisory recommends blocking untrusted Brotli-compressed data where practical until patches are applied.
• Rebuild affected applications and container images, redeploy and restart services. Aikido Security's guidance is to update dependency locks, rebuild, redeploy and restart, then verify that running workloads use the patched components. A rebuilt image that still pins the old decoder is not remediated.

P2, within 72 hours:

• Update Envoy Proxy to 1.36.12, 1.37.8, 1.38.6, 1.39.3 or 1.40.0, and Istio to 1.29.9, 1.30.6 or 1.31.2. These sit at the edge and decompress inbound request bodies.
• Update Bun to 1.4.4, Python Brotli to 1.2.1, brotlicffi to 1.2.1.0, and PHP for Windows to 8.2.35-1, 8.3.36-1, 8.4.27-1 or 8.5.12-1.
• Apply distribution packages for Brotli 1.0.10, 1.1.1 or 1.2.1 where the OS package manager supplies the decoder.
• Review FFmpeg and Apache Arrow deployments that process untrusted JPEG XL or Brotli-compressed input; JFrog showed FFmpeg reaches the decoder through libjxl brob boxes, and Apache Arrow is affected with denial of service.

P3, within 7 days:

• Add a dependency check for the Brotli decoder version to CI so future base-image builds cannot reintroduce an affected version.
• Confirm with third-party providers and managed service operators which of the affected components they run and when they will ship fixed versions.

5. Indicators of compromise

ipv4  94.154[.]43[.]7

The IP above is the only atomic indicator in the source material, and it rests on a single vendor's sensor reporting. Verify before blocking; it is not corroborated by a second source in this set. No file hashes, domains or filenames are given in the sources.

Behavioural indicators:

6. Detection

The sources give no file artefacts, command-line flags, mutexes or filenames specific to an exploit, so a YARA rule built on threat artefacts cannot be written without fabricating strings. Detection should target the behaviour: services that decompress untrusted Brotli data, and crashes in those services.

title: Brotli decoder crash or memory fault in a decompressing service
id: 7f3c1a2e-9b64-4d21-8c0e-2a5e6f1d4b90
status: experimental
description: Flags abnormal termination or memory fault in processes that decompress Brotli content, consistent with CVE-2026-111497 exploitation attempts.
author: Adverse Trace
date: 2026-10-27
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-111497
  - https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:

      - '/node'
      - '/dotnet'
      - '/envoy'
      - '/bun'
      - '/php'
  selection_fault:
    CommandLine|contains:

      - 'Segmentation fault'
      - 'SIGSEGV'
  condition: selection_proc and selection_fault
falsepositives:

  - Ordinary application crashes unrelated to Brotli input
level: medium

This rule is a starting point for triage, not a signature of the exploit. Pair it with application-layer logging of requests whose Content-Encoding or Accept-Encoding is br, and with crash-dump collection on the runtimes listed in §3.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-111497 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-111497, published 2026-10-27.
• Tenable Research, Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497), https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497.
• Rapid7, CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder, https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder, 2026-10-26.
• The Hacker News, Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software, https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html.
• Help Net Security, Brotli bug reaches far beyond Node.js (CVE-2026-111497), https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/, 2026-10-27.
• The Register, Microsoft releases emergency .NET security fixes for Google Brotli bug, https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515, 2026-10-26.
• Risky Business News, Risky Bulletin: While everyone was looking at PHP, another RCE is wrecking what's left of the internet, https://news.risky.biz/risky-bulletin-while-everyone-was-looking-at-php-another-rce-is-wrecking-whats-left-of-the-internet/.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-111497 as 9.2 CRITICAL per the NVD record, not in CISA KEV, with EPSS at 55% and public exploit code available. The KEV absence lowers the mandatory-remediation driver but not the technical risk: the decoder is embedded across Node.js, .NET, Envoy, Istio and Python packages, and remediation requires rebuilding and redeploying downstream artefacts, which most clients cannot complete inside a normal patch cycle. The in-the-wild exploitation claim from ELLIO is single-sourced and we treat it as unconfirmed until a second sensor network corroborates it; the IP in §5 should not be blocked on our say-so alone. We will track downstream vendor releases for the remaining affected projects, re-check KEV and EPSS status, and update this advisory when corroborated exploitation reporting or a CISA KEV addition appears.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.