{"cve":{"cve_id":"CVE-2026-111497","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":null,"epss_percentile":null,"epss_as_of":null,"description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","published_at":"2026-10-22T13:35:41.975000Z","last_modified_at":"2026-10-24T18:16:47.170000Z","cvss_v3_score":null,"cvss_v3_vector":null,"cvss_v3_severity":null,"cvss_v4_score":9.2,"cvss_v4_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvss_v4_severity":"CRITICAL","ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-787","CWE-252"],"nvd_references":["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"],"vuln_status":"Awaiting Analysis","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-10-22T15:23:35.652581Z","updated_at":"2026-10-25T14:50:36.689930Z"},"effective_severity":"CRITICAL","badges":["poc","news"],"impact_analysis":[],"cvss_v3_decoded":{"version":null,"metrics":[]},"cvss_v4_decoded":{"version":"4.0","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"AT","name":"Attack Requirements","value":"P","value_label":"Present"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"VC","name":"Confidentiality (Vulnerable System)","value":"H","value_label":"High"},{"metric":"VI","name":"Integrity (Vulnerable System)","value":"H","value_label":"High"},{"metric":"VA","name":"Availability (Vulnerable System)","value":"H","value_label":"High"},{"metric":"SC","name":"Confidentiality (Subsequent System)","value":"N","value_label":"None"},{"metric":"SI","name":"Integrity (Subsequent System)","value":"N","value_label":"None"},{"metric":"SA","name":"Availability (Subsequent System)","value":"N","value_label":"None"}]},"affected":[{"vendor_slug":"google","vendor_name":"Google","product_slug":"brotli","product_name":"Brotli","version_start":"1.0.3","version_start_inclusive":true,"version_end":"1.0.10","version_end_inclusive":false,"cpe23_uri":"cve5:google:brotli:1.0.3:1.0.10"},{"vendor_slug":"google","vendor_name":"Google","product_slug":"brotli","product_name":"Brotli","version_start":"1.1.0","version_start_inclusive":true,"version_end":"1.1.1","version_end_inclusive":false,"cpe23_uri":"cve5:google:brotli:1.1.0:1.1.1"},{"vendor_slug":"google","vendor_name":"Google","product_slug":"brotli","product_name":"Brotli","version_start":"1.2.0","version_start_inclusive":true,"version_end":"1.2.1","version_end_inclusive":false,"cpe23_uri":"cve5:google:brotli:1.2.0:1.2.1"}],"exploit_refs":[{"source":"nuclei","kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/javascript/cves/2026/CVE-2026-111497.yaml","title":"Node.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Execution","author":"assetnote,DhiyaneshDk","disclosed_at":null}],"news":[{"id":2874,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/php-issues-second-windows-security.html","title":"PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw","summary":"PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.\n\nPHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWGYEqFaRxRywsWzBt-2T2G_Jpdp4zy3iV7qI1alNGRaBf_8TMdzRQQb335GhASkVoXD3q9mGkiLjAog4ez9d7DHhl88lkNVvuhI74KiKZP0zZpb2O8yyqyDw12WoYTiGaq1AVfG9TfGcdNhP-DmRwuKJ4Pj4mr9rEo-TVLYxYSpmUogJUSFZFL_VaduQ/s1600/php-windows.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-26T17:45:57Z","fetched_at":"2026-10-26T18:08:05.582301Z","trending_score":1.2523591495787036,"cve_ids":["CVE-2026-111497"]},{"id":2851,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html","title":"Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software","summary":"A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.\n\nTracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxIIerJT3LOMCGn3nXAnmhaHzJlJnVJCso1COluq8t3WuF4IpNARa_Asl5nEhRUDTEcR89kwzo5vGmP5IyNbj1ncdaCpkhqcHUODHAd3khanaE-7N8Vb0NyEJkmPmNkhSpJtLCLgi9srDRhZLtM5n8UDI58F797ZJaVzC7JzjPLfca4NpxZr_7tCX8RIk/s1600/br-nodejs.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-24T08:45:56Z","fetched_at":"2026-10-24T10:41:54.040138Z","trending_score":0.5498624098525806,"cve_ids":["CVE-2026-111497"]},{"id":2824,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html","title":"Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","summary":"Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.\n\nTheir \"Node2Shell\" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDudJHAM27KiE-F4E5vX1WOgITTdawUaZrFoXUIrf7lscEHIl7fgGQY5Qo60bRxr-o7UKloYK1sp23i5cvWPpc6XXttZa8GFvYxqSV7pp0B6vdBTp0sIBCX8r8oC5CAXO1mdJfshaIpLFyrFDCm9HPiYyBZMECEcSHKzbVzOk_VpGL2kEQDjB1rNk21Y8/s1600/node2shell.gif","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-23T07:50:01Z","fetched_at":"2026-10-23T08:09:16.353305Z","trending_score":0.3836139419016918,"cve_ids":["CVE-2026-111497"]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-10-22T13:35:41.975000Z","label":"CVE published","source":null},{"type":"first_article","at":"2026-10-23T07:50:01Z","label":"First news coverage","source":"The Hacker News"},{"type":"poc_available","at":"2026-10-26T20:42:00.689726Z","label":"Public PoC available","source":"nuclei"}]}