Brotli - RCE (CVE-2026-111497)

CVE-2026-111497 is a critical out-of-bounds write in Google's Brotli decoder, rated 9.2 on CVSS v4.0 and listed in CISA's Known Exploited Vulnerabilities catalog. An invalid block switch in a crafted Brotli stream is reported as a need for more input instead of a format error, so the streaming decoder keeps appending attacker bytes past the end of an eight-byte internal buffer and corrupts decoder state. Any application that decompresses attacker-controlled Brotli data is exposed: Node.js, Bun, Python packages, Envoy, PAN-OS and more. On Node.js, an unauthenticated attacker can crash the process, leak process memory or execute arbitrary code by sending a Brotli-compressed request body to an Express 5, body-parser 2 or Koa application, or by serving a Brotli-encoded response to a server-side fetch. It is disclosed under the names "Node2Shell" and "Broccoli2Shell".

CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-111497 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send a POST request to any endpoint of a Node.js application that inflates request bodies (Express 5, body-parser 2, Koa) with a Content-Encoding: br header and a malformed Brotli stream as body. Detection should focus on the Content-Encoding: br request header, since browsers never send Brotli-compressed request bodies.