# CVE-2026-111497: Brotli - RCE

> Live exploitation tracking for CVE-2026-111497 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-111497

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 9.2
- **Public exploit available:** Yes
- **Affected products:** Google Brotli, OpenJS Foundation Node.js
- **Weaknesses:** CWE-787 (Out-of-bounds Write); CWE-252 (Unchecked Return Value)
- **Tags:** nodejs, c

## Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. The decoder is bundled in Node.js, Bun, the Python Brotli and brotlicffi packages and other software. Disclosed publicly as "Node2Shell" and "Broccoli2Shell".

## CrowdSec analysis

[CVE-2026-111497](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-111497) is a critical out-of-bounds write in Google's Brotli decoder, rated 9.2 on CVSS v4.0 and listed in CISA's Known Exploited Vulnerabilities catalog. An invalid block switch in a crafted Brotli stream is reported as a need for more input instead of a format error, so the streaming decoder keeps appending attacker bytes past the end of an eight-byte internal buffer and corrupts decoder state. Any application that decompresses attacker-controlled Brotli data is exposed: Node.js, Bun, Python packages, Envoy, PAN-OS and more. On Node.js, an unauthenticated attacker can crash the process, leak process memory or execute arbitrary code by sending a Brotli-compressed request body to an Express 5, body-parser 2 or Koa application, or by serving a Brotli-encoded response to a server-side fetch. It is disclosed under the names "Node2Shell" and "Broccoli2Shell".

CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-111497 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send a POST request to any endpoint of a Node.js application that inflates request bodies (Express 5, body-parser 2, Koa) with a `Content-Encoding: br` header and a malformed Brotli stream as body. Detection should focus on the `Content-Encoding: br` request header, since browsers never send Brotli-compressed request bodies.

## Timeline

- 2026-10-22: CVE Published. CVE-2026-111497 is published to NVD.
- 2026-10-27: CISA KEV. CVE-2026-111497 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-10-28: Rule Released. CrowdSec releases a rule to detect CVE-2026-111497 exploitation attempts against the CrowdSec Network.
- 2026-11-10: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- https://github.com/google/brotli/releases/tag/v1.2.1
- https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/
- https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
- https://broccoli2shell.com
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
- https://github.com/assetnote/node2shell-scanner
- https://github.com/syrex1013/CVE-2026-111497-node2shell

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-111497) follows observed exploitation activity for CVE-2026-111497. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.