AX·NEWS
Sign in

Vulnerability

CVE-2026-111497 — Google Brotli memory corruption

critical 9.2 6 stories · 4 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • Google Brotli < 1.0.10 · < 1.1.1 · < 1.2.1

Memory corruption · over the network · no login

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decod

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
    INThe Hacker News Cybersecurity

    PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP…

  2. This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli
    USlobste.rs Software Engineering

    Comments

  3. Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
    INThe Hacker News Cybersecurity

    A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli…

  4. Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
    USHacker News Front Page Software Engineering

    https://www.aikido.dev/blog/python-packages-vulnerable-node2... Comments URL: https://news.ycombinator.com/item?id=50219177 Points: 369 # Comments: 189

  5. Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
    INThe Hacker News Cybersecurity

    Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image…

  6. Please update immediately: Node.js release high-risk security updates at the highest level
    CNIT Home (EN Mirror) Hardware Translated from zh-cn