A critical buffer-overflow vulnerability, tracked as CVE-2026-111497 and referred to as “Node2Shell,” affects Google Brotli and numerous applications and platforms that rely on Brotli decompression. Attackers are actively exploiting the vulnerability, which may allow remote execution of arbitrary code on affected systems.
Organizations should identify affected software and prioritize vendor-provided security updates. Temporary mitigations may reduce exposure when immediate patching is not possible, but they should not replace applicable updates.
What is the threat?
CVE-2026-111497 is a heap buffer-overflow vulnerability in how Brotli processes block-type switches during streaming decompression. When the decoder finishes processing a block, it checks the next block type and prepares its internal state.
The vulnerability occurs when a malformed Brotli stream triggers an invalid block-switch code. Successful exploitation of this memory-corruption condition may allow an attacker to execute arbitrary code within the affected application. The resulting access depends on the privileges assigned to that process or service.
Why is it noteworthy?
This vulnerability is significant because Brotli is not limited to a single operating system or product. The compression technology appears across web applications, development runtimes, reverse proxies, security appliances, command-line tools, and data-processing software.
Organizations may have indirect exposure through software containing a vulnerable Brotli library, even if they did not install or manage Brotli separately.
What is the exposure or risk?
Successful exploitation could corrupt application memory and potentially allow arbitrary code execution on a vulnerable system.
The following are potentially affected technologies and versions:
- Google Brotli: Versions 1.0.3 through 1.2.0, with fixes available in versions 1.0.10, 1.1.1, and 1.2.1.
- Node.js: Version branches 22.x, 24.x, 26.x, and end-of-life branches.
- .NET Runtime: Versions 8.0, 9.0, 10.0, and 11 Release Candidate.
- Microsoft products: Visual Studio 2019, 2022, and 2026, as well as PowerShell 7.4, 7.5, and 7.6.
- Python: The Brotli and brotlicffi packages.
- Envoy and Istio: Envoy versions 1.36 through 1.40 and Istio versions 1.29 through 1.31.
- Bun: Versions earlier than the identified 1.4.4 fix.
- PHP: PHP for Windows 8.2 through 8.5 and the PECL Brotli extension.
- PAN-OS: Potential exposure when Brotli inspection and TLS decryption are enabled.\
- Additional products: FFmpeg, ClickHouse, Apache Arrow, and VMware SDDC Manager.
Depending on the affected product and its operating privileges, potential consequences include:
- Unauthorized execution of commands or attacker-controlled code.
- Compromise of the affected application or service.
- Unauthorized access to sensitive information available to the affected process.
- Modification or destruction of application data.
- Installation of additional tools or persistent-access mechanisms.
- Disruption of applications, proxies, development platforms, or security services.
- Further movement into connected systems if the compromised application can access internal resources.
Because other products may embed the vulnerable component, organizations should assess both installed Brotli packages and applications that bundle or depend on the affected library.
What are the recommendations?
Barracuda recommends the following actions to reduce risk:
Apply vendor updates immediately:
- Google Brotli: Upgrade to 1.0.10, 1.1.1, or 1.2.1.
- Node.js: Upgrade to 22.23.4, 24.22.1, or 26.12.1.
- .NET Runtime: Upgrade to 8.0.33, 9.0.22, 10.0.14, or .NET 11 RC3.
- Python Brotli: Upgrade to 1.2.1 or later.
- Python brotlicffi: Upgrade to 1.2.1.0 or later.
- Envoy: Upgrade to the applicable patched version for your deployed branch.
- Bun: Upgrade to 1.4.4.
- PAN-OS: Apply the appropriate vendor hotfix.
- Other affected products: Apply available updates for Visual Studio, PowerShell, PHP, Istio, FFmpeg, ClickHouse, Apache Arrow, VMware SDDC Manager, and other products using Brotli.
If immediate patching is not possible:
- Block incoming requests containing
Content-Encoding: brat the web application firewall, reverse proxy, or load balancer. - Note that this does not protect applications retrieving Brotli-compressed content from external servers.
- For Azure Web Application Firewall, use DRS 2.2 or consider a custom rule matching
brin the Content-Encoding header. - Confirm ASLR is enabled on affected systems.
- For PAN-OS, review Brotli settings and apply the applicable hotfix.
Conduct threat hunting: Check for application crashes, suspicious child processes, new executables or scripts, anomalous connections, configuration changes, and unusual service-account activity.
Increase monitoring: Review authentication, system, and application logs, process activity, and network traffic for suspicious behavior.
References
For more information, review the following resources:
- https://nvd.nist.gov/vuln/detail/cve-2026-111497
- https://security.paloaltonetworks.com/CVE-2026-111497
- https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497
- https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.