Skip to content
securitytabs

LiveUpdated

Brotli decompression flaw lets crafted data run code in Node.js, PHP and other software

A flaw in a widely used data-decompression component can let specially crafted data take over programs built on Node.js and several other tools. Organizations that run such software should check for vendor updates; Node.js and PHP have released fixes.

Written by the SecurityTabs AI newsroom from 4 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Rapid7 says the Node.js Project published a security advisory on October 21, 2026 for CVE-2026-111497, an out-of-bounds write (writing data past the end of a memory buffer) in the Brotli decoder bundled with Node.js. It affects the Node.js 26.x, 24.x and 22.x release lines. Rapid7 says an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, disclosure of sensitive memory, or remote code execution. [1]

Node.js rates the issue High, while Google, the CVE Numbering Authority, gives it a critical CVSS v4 score of 9.2, according to Rapid7. CISA's Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, does not list the flaw. [1]

Proof of concept

The Hacker News reports that researchers at Imperva demonstrated a proof of concept called Node2Shell that ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder. Wiz has published a write-up, titled Broccoli2shell, on detecting and mitigating the flaw. The sources reviewed do not report attacks in the wild. [2][3]

Other affected software

The Hacker News reports the flaw sits in Google's Brotli decoder, so it also affects other programs that unpack Brotli data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. [4]

The Hacker News also reports PHP rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix the flaw. PHP says it can be reached through the cURL extension when it decompresses HTTP responses automatically, which cURL leaves off by default. SANS reports that Microsoft and PHP have shipped out-of-band updates. [5][6]

What is not yet known

The sources reviewed do not report exploitation by attackers, and the full list of fixed versions for each product is set out in the vendors' own advisories. [1][4]

Timeline

  1. SANS reported out-of-band Brotli fixes from Microsoft and PHP. [6]

  2. Rapid7 published an analysis and The Hacker News reported PHP's rebuilt Windows packages. [1][5]

  3. Wiz published guidance on detecting and mitigating the flaw. [3]

  4. The Hacker News reported the flaw also affects Bun, .NET, Python packages and Envoy. [4]

  5. The Hacker News reported Imperva's Node2Shell proof of concept. [2]

  6. The Node.js Project published a security advisory for the Brotli decoder flaw. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Most small organizations do not run this software directly, but websites, apps or tools from providers may use Node.js, PHP or .NET. Node.js, PHP and Microsoft have released fixes. [5][6]

What to do

  1. Ask your hosting provider or software vendor whether their Node.js, PHP or .NET components have received the Brotli update. [6][4]
  2. Install available updates for affected software. [5]

Mid-size company

A small IT or security team

What to know

Rapid7 says Node.js 26.x, 24.x and 22.x are affected, and the same decoder appears in other products, including Bun, .NET and Python packages. [1][4]

What to do

  1. List applications that use Node.js, Bun, .NET, the Python Brotli packages, or PHP on Windows, and apply the vendors' updates. [4][5][6]
  2. Check whether Envoy proxies are set up to decompress Brotli. [4]

Large enterprise

A security operations team

What to know

The flaw can be reached by supplying Brotli data to applications that decompress it. Wiz and Rapid7 have published detection and mitigation analysis, and no exploitation in the wild is reported in the sources reviewed. [3][1]

What to do

  1. Inventory services and container images that bundle Node.js or other Brotli-using components and prioritise those that decompress untrusted input. [1][4]
  2. Review the Wiz and Rapid7 write-ups for detection and mitigation guidance. [3][1]
  3. Track vendor advisories for fixed versions and monitor for exploitation reports. [1]

Sources

  1. [1]Rapid7 Blog · Oct 26, 17:32 UTC
    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decodercontext
  2. [2]The Hacker News · Oct 23, 07:50 UTC
    Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Datacontext
  3. [3]Wiz Blog · Oct 25, 14:46 UTC
    Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerabilitycontext
  4. [4]The Hacker News · Oct 24, 11:09 UTC
    Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Softwarecontext
  5. [5]The Hacker News · Oct 26, 17:45 UTC
    PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawcontext
  6. [6]SANS Internet Storm Center StormCast · Oct 27, 02:55 UTC
    SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)context