A flaw in the decoder of the Brotli compression library lets crafted compressed data write past the end of an internal buffer. Out-of-band fixes are available for Node.js, for .NET and for the PHP builds for Windows. Nobody has confirmed exploitation in the wild so far, but proof-of-concept code is public.
Status as of 27 October 2026 according to the Node.js, Microsoft and PHP advisories.
What happened
Brotli is a compression library from Google. It is used mainly to transfer data over HTTP (the Content-Encoding br header), so in a corporate environment you will find it in servers, in HTTP clients and in libraries whose names give no hint of it.
CVE-2026-111497, also known as Node2Shell, HTTP2Shell and Broccoli2Shell, is an out-of-bounds write. According to the Node.js advisory, the decoder treats an invalid block switch as a temporary need for more input instead of a permanent format error, and keeps appending input bytes to an eight-byte internal buffer. That corrupts nearby process memory. The result can be a crash, disclosure of process memory, or remote code execution.
The attacker needs no authentication. It is enough that an application decompresses data the attacker controls. There are two routes: the application accepts a compressed request as a server, or it fetches a compressed response as a client from an address the attacker influences.
Severity ratings differ between sources. Node.js rates the flaw as high, and Microsoft shipped an out-of-band fix outside its regular monthly cycle. A single CVSS figure was not consistent across sources when this article was written, so we do not quote one. The flaw is not listed in the CISA KEV catalogue of exploited vulnerabilities.
Does this affect you?
Affected Brotli versions are 1.0.3 to 1.0.9, 1.1.0 and 1.2.0, together with software that bundles the library. In practice that means:
- Node.js in the 22.x, 24.x and 26.x lines, anywhere an application decompresses data through node:zlib.
- .NET versions 8, 9, 10 and 11 RC2. According to Microsoft, .NET Framework is not affected.
- PHP for Windows. According to the PHP announcement, the vulnerable decoder can be reached through the cURL extension when automatic decompression of HTTP responses is enabled. It is off by default in cURL, but applications and HTTP client libraries do turn it on.
- Python, specifically the brotli and brotlicffi packages and the HTTP clients that use them (urllib3 with brotli support, requests, httpx, aiohttp).
One detail is easy to miss during the clean-up. Updating the system Brotli library is not enough on its own: applications that bundle their own copy, typically Node.js or .NET, have to be updated separately. Each place in the diagram below is therefore updated on its own.
Updating the system library is not enough, bundled copies are updated separately.
What to do now
- Update Node.js to 22.23.4, 24.22.1 or 26.12.1.
- Update .NET to 8.0.33, 9.0.22 or 10.0.14, and prerelease installations to .NET 11 RC3. Microsoft released the fix on 25 October 2026 and recommends updating build environments as well.
- Update PHP on Windows to builds 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1, which include Brotli 1.2.1.
- Update the Brotli library itself to 1.0.10, 1.1.1 or 1.2.1. In Python that means the brotli package at 1.2.1 and brotlicffi at 1.2.1.0.
- After updating, restart the affected processes and rebuild and redeploy container images. Without that the old library keeps running.
If you cannot update straight away, reduce the places where your applications decompress third-party data. In Python, remove Brotli support, and block inbound Brotli-compressed requests at the proxy or firewall. That does not cover the second route, the response your own application fetches.
Struggling to keep track?
Several out-of-band fixes have shipped in the past week alone, and most organisations have nobody going through vendor advisories every day and deciding what applies to them. We help customers set up vulnerability management so that it is clear who watches the sources, how priority is decided and within what deadline each fix is deployed. If you want to start, use our contact page or look at our security assessment.
Sources: Node.js, security releases of 21 October 2026 · Microsoft, .NET out-of-band security updates of 25 October 2026 · PHP, updated Windows builds of 26 October 2026 · BleepingComputer, affected Brotli versions and interim mitigations