Skip to content
securitytabs

LiveUpdated · 2 updates

Brotli Decompression Flaw in Node.js and Other Software Under Attack

A flaw in a widely used data-decompression library can let attackers crash programs or run their own code, and it is now being exploited. Organizations that run Node.js or other software bundling the library should check for vendor updates now.

Written by the SecurityTabs AI newsroom from 7 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

  1. Added Datadog Security Labs' reproduction and detection guidance, credited original sources instead of outlets, and revised the timeline and Business Action. [1]

  2. Corrected the scoring: the record now carries a CVSS score of 9.2, so the earlier statement that NVD had published none was removed. [2]

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

The Node.js Project published a security advisory on October 21, 2026 for CVE-2026-111497, an out-of-bounds write (a program writing data past the end of its memory buffer) in the Brotli decoder bundled with Node.js, Rapid7 says. It affects the 26.x, 24.x and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority, gives it a critical score of 9.2. [3]

Rapid7 says an attacker who can supply Brotli data that an application decompresses can corrupt process memory. According to Node.js, as cited by Rapid7, this can lead to a crash, disclosure of sensitive process memory, or remote code execution. Datadog Security Labs says it reproduced the flaw and has published how to detect and remediate it. [3][1]

Other affected software

The flaw sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli, according to The Hacker News. [4]

PHP rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix the flaw, which PHP says can be reached through the cURL extension when it decompresses HTTP responses automatically. cURL leaves that off by default. [5]

Exploitation

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 27, based on evidence of active exploitation. CISA's federal due date is November 10, 2026. [2][6]

Sophos, which calls the Node.js flaw Node2Shell, says it is in active exploitation, and The Hacker News reports Brotli exploit traffic has emerged. The Canadian Centre for Cyber Security issued an alert on October 28. The available excerpts do not describe who is behind the attacks or how many systems are affected. [7][6][8]

Timeline

  1. Datadog Security Labs published a reproduction of the flaw with detection and remediation steps. [1]

  2. Sophos reported active exploitation and the Canadian Centre for Cyber Security issued an alert. [7][8]

  3. CISA added the flaw to its KEV catalogue. [2]

  4. PHP rebuilt its Windows packages to fix the flaw. [5]

  5. The Node.js Project published a security advisory for the Brotli decoder flaw. [3]

Update history

  1. Added Datadog Security Labs' reproduction and detection guidance, credited original sources instead of outlets, and revised the timeline and Business Action. [1]

  2. Corrected the scoring: the record now carries a CVSS score of 9.2, so the earlier statement that NVD had published none was removed. [2]

  3. First published

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your website or apps are built on Node.js or similar tools, your developer or hosting provider is responsible for updating them, and the flaw is being exploited. [3][2]

What to do

  1. Ask your hosting provider or developer whether your Node.js version has the October 21 fix. [3]
  2. Ask them whether any other software you use, such as Python, .NET or PHP on Windows, bundles the Brotli library and has been updated. [4][5]

Mid-size company

A small IT or security team

What to know

The flaw is in a library embedded in many products, so it may sit in software that is not obviously Node.js; CISA lists it as exploited. [4][2]

What to do

  1. Inventory Node.js 22, 24 and 26 deployments and apply the Node.js Project's fixed releases. [3]
  2. Check Bun, .NET, Python Brotli packages, Envoy and PHP on Windows against their vendors' updates. [4][5]
  3. Use the CISA KEV catalogue's November 10 due date as a guide for priority. [2]

Large enterprise

A security operations team

What to know

Vendors have issued separate fixes, Sophos reports active exploitation, and Datadog, Wiz and Rapid7 have published guidance; no sources yet describe indicators or attribution. [7][1][9][3]

What to do

  1. Inventory services that decompress untrusted Brotli data, including Node.js, Bun, .NET, Python and Envoy deployments, and patch them. [4][3]
  2. Review Wiz, Rapid7 and Datadog detection and mitigation guidance for CVE-2026-111497. [9][3][1]
  3. Hunt for crashes or unexpected process behaviour in affected services since October 21. [3][1]

Sources

  1. [1]Datadog Security Labs · Oct 29, 00:00 UTC
    Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decodercontext
  2. [2]CISA Advisories · Oct 27, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext
  3. [3]Rapid7 Blog · Oct 26, 17:32 UTC
    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decodercontext
  4. [4]The Hacker News · Oct 24, 11:09 UTC
    Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Softwarecontext
  5. [5]The Hacker News · Oct 26, 17:45 UTC
    PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawcontext
  6. [6]The Hacker News · Oct 28, 05:42 UTC
    Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergescontext
  7. [7]Sophos News · Oct 28, 00:00 UTC
    ‘Node2Shell’ vulnerability (CVE-2026-111497) in active exploitationcontext
  8. [8]Canadian Centre for Cyber Security · Oct 28, 12:46 UTC
    AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497context
  9. [9]Wiz Blog · Oct 25, 14:46 UTC
    Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerabilitycontext