No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Exploits & detection
Exploitassetnote/node2shell-scanner · github · ★ 85 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitdimasma0305/CVE-2026-111497-POC · github · ★ 77 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploittrailofbits/brotli-checker · github · ★ 68 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitsyrex1013/CVE-2026-111497-node2shell · github · ★ 52 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitcaveeroo/cve-2026-111497-wordpress-poc · github · ★ 31 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitZeroHackOrg/node2shell-poc · github · ★ 8 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploithypnguyen1209/CVE-2026-111497 · github · ★ 7 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitikow/brotli2crash · github · ★ 6 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploittc4dy/CVE-2026-111497-Toolkit · github · ★ 4 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitTheFool-TAROT/CVE-2026-111497-brotli-pwn · github · ★ 3 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitshivrajem/node2shell-detect · github · ★ 3 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitArkango/CVE-2026-111497 · github · ★ 2 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitCompleteTech-Security/node2shell-check · github · ★ 2 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitAdapptOnAzure/cve-2026-111497-mitigation · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitCharlie-Netdevops/node-hostcheck · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitGhost-Bx1/Node2Shell-CVE-2026-111497 · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitSami-AlEsh/nodejs-security-check · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitw116tjb/CVE-2026-111497_nodejs_hash_lookup · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitAmanSin001/node-brotli-check · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitBlackman99/lotstamp · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitTahuCryptsi/brotli-distro-check · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitTahuCryptsi/node-brotli-check · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitdatmt/vulcheck · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitduytien241/nodejs-CVE-2026-111497 · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitfuzheado/n2s-buildpack-probe · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitincu-tech/october-cyber-family · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitks-labs/brotli-patch · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitmahumadad/CVE-2026-111497-assessment · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
1 repository link(s) hidden as suspicious (binaries, password-protected archives or lure wording).
In the news
- HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress SitesWordfence · 02 Nov 2026
- WordPress doesn’t ship Brotli. It’s still exposed to CVE-2026-111497Patchstack · 30 Oct 2026
Timeline
- Published: 22 Oct 2026
- Last modified upstream: 04 Nov 2026
- Added to CISA KEV: 27 Oct 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/andybalholm/brotli/releases/tag/v1.2.7 (Release Notes)
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high (Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/10/23/25 (Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/10/24/6 (Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/10/26/12 (Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/10/26/13 (Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/10/26/16 (Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/11/03/2 (Mailing List, Third Party Advisory)
- https://broccoli2shell.com (Third Party Advisory)
- https://github.com/advisories/GHSA-9v8h-qqgm-4m35 (Third Party Advisory)
- https://github.com/dotnet/announcements/issues/494 (Issue Tracking, Mitigation, Third Party Advisory)
- https://github.com/google/brotli/releases/tag/v1.0.10 (Release Notes)
- Analysis, summary and remediation
- © VulnCrest