Is the Brotli decoder flaw CVE-2026-111497 in my servers and apps, and what should I do?
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, nicknamed HTTP2Shell, Node2Shell and Broccoli2Shell in public research. Anything that decompresses attacker-supplied Brotli data with a vulnerable decoder is exposed, and the library sits inside Node.js, Bun, Python packages, .NET, PowerShell, Envoy, PHP for Windows builds and Linux distributions. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Update to a fixed version, restart every process that loaded the old library, rebuild anything that bundles its own copy and hunt for compromise.
Added to CISA KEV on 27 Oct 2026
CISA lists CVE-2026-111497 in its Known Exploited Vulnerabilities catalogue, which means it has evidence of exploitation. Its 10 November 2026 due date applies only to US federal agencies under BOD 26-04. It is not a UK deadline, but treat it as a strong signal to act now. Known ransomware use is listed as Unknown and CISA does not require forensic triage for this entry.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 27 October 2026, 22:45 GMT.
At a Glance
Based on Google, CISA, NVD and the affected projects' own advisories as of 27 October 2026. Last updated 27 October 2026, 22:45 GMT.
CVSS 4.0 9.2
Critical, scored by Google as the CVE numbering authority. NVD has not scored it yet. Node.js rates it High and Microsoft gives CVSS 3.1 8.1.
Exploited, in CISA KEV
Added on 27 October 2026. No exploitation details or indicators have been published by a primary source.
Decoding untrusted Brotli
Servers that accept Brotli request bodies, clients that decompress Brotli responses, proxies with a Brotli decompressor and code that reads .br data.
Update and restart
Brotli 1.0.10, 1.1.1 or 1.2.1, or the fixed runtime or package below. Restart processes and rebuild bundled copies.
Google releases Brotli 1.0.10, 1.1.1 and 1.2.1 with the fix for an out-of-bounds write in the decoder.
Google publishes CVE-2026-111497. Bun 1.4.4 and the fixed Python packages follow the same day.
PHP publishes rebuilt Windows builds with Brotli 1.2.1.
CISA adds CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue.
Who is exposed
- Brotli is a compression library. Only decompressing attacker-supplied data with a vulnerable decoder is the risk. Compressing data is not.
- Web servers and APIs that accept
Content-Encoding: brrequest bodies. Express 5 inflates Brotli request bodies by default through body-parser. - HTTP clients that decompress Brotli responses from untrusted URLs, such as webhooks, link previews and scrapers. Node.js fetch does, and Python urllib3, httpx and aiohttp do when Brotli or brotlicffi is installed.
- Envoy, but only with a Brotli decompressor filter configured.
- .NET only when Brotli request decompression, HttpClient automatic decompression with Brotli or the Brotli APIs are used. .NET Framework is not affected.
- PHP only when cURL automatic decompression is turned on. It is off by default, but Guzzle enables it.
- Anything that bundles its own Brotli: official Node.js downloads, Bun, Python wheels, container images, Electron apps, self-contained .NET apps and appliances.
The framework behaviour above comes from their source code rather than from a vendor advisory. Node.js and Microsoft are the only vendors that state their own exposure paths.
Affected and fixed versions
| Product | Affected | Fixed | Notes |
|---|---|---|---|
| Google Brotli (C library) | 1.0.3 to 1.0.9, 1.1.0, 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | Versions before 1.0.3 are not affected. |
| Node.js 22, 24 and 26 | Before the fixed release on each line | 22.23.4, 24.22.1, 26.12.1 | Rated High by Node.js. Node.js 20 and older are end of life and get no fix. |
| Bun | Before 1.4.4 | 1.4.4 | The release notes list a Brotli security fix but do not name the CVE. |
| Python Brotli and brotlicffi | 1.0.3 up to the fix | Brotli 1.2.1, brotlicffi 1.2.1.0 | PyPI has no 1.0.10 or 1.1.1 release, so upgrade to 1.2.1. |
| .NET 8, 9 and 10 | Before the fixed runtime | 8.0.33, 9.0.22, 10.0.14 | Microsoft scores it CVSS 3.1 8.1. Not exposed by default (see below). .NET Framework is not affected. .NET 11 previews are affected and fixed in RC3. |
| PowerShell 7.4, 7.5 and 7.6 | Before the fix | 7.4.22, 7.5.13, 7.6.9 | |
| Visual Studio | 2019 16.11, 2022 17.14, 2026 18.11 and 18.12 | 16.11.61, 17.14.43, 18.11.2, 18.12 Insiders 3 | |
| Envoy | 1.39.2, 1.38.5, 1.37.7, 1.36.11 and earlier | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | Only when a Brotli decompressor filter is configured. |
| PHP for Windows | 8.2.35, 8.3.36, 8.4.27, 8.5.12 and older Windows builds | Rebuilds 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 | The rebuild still shows the old number in php -v. |
| curl for Windows (curl.se builds) | Builds with an older Brotli | 8.23.0_5 | Only decodes Brotli with --compressed. The curl.exe in Windows System32 is a separate build: check curl -V. |
| Go port andybalholm/brotli | Before v1.2.7 | v1.2.7 | Referenced in Google's CVE record. The tag has no release notes. |
| Debian, Ubuntu, Azure Linux | Distribution libbrotli packages | Updated packages | Update libbrotli1 and restart the processes that use it. Ubuntu 20.04 and older are still listed as needing evaluation. |
Debian fixed versions: 1.0.9-2+deb12u1 (bookworm) and 1.1.0-2+deb13u1 (trixie). Ubuntu: 1.2.0-4ubuntu0.1 (26.10), 1.2.0-3ubuntu0.1 (26.04), 1.1.0-2ubuntu0.1 (24.04) and 1.0.9-2ubuntu0.1 (22.04). Azure Linux 3.0: nodejs 24.22.1-1 and brotli 1.2.1-1.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Tick both tracks.
Find, update and restart
- Inventory Node.js, Bun, Python, .NET, PowerShell, Envoy, PHP for Windows and libbrotli on every host you or your clients run.
- Update internet-facing services first: APIs that accept request bodies, and apps that fetch untrusted URLs.
- Restart every process that loaded the old library.
- Reject
Content-Encoding: brat the edge where your apps do not need it.
Hunt and contain
- Hunt for Brotli-decoding runtimes spawning shells.
- Look for crash and restart loops in Node.js, Bun, Python, IIS and Envoy.
- Rotate secrets on any host that shows signs of compromise, as the flaw can disclose memory.
- Rebuild compromised hosts and containers from clean images.
Proactive: Check Exposure and Fix
Brotli is embedded in many runtimes and packages, so start with an inventory rather than a single version check.
Inventory every copy of Brotli
Run the free checkers below on each server, build agent and developer machine, and point them at application folders, virtual environments and extracted container images. In Microsoft Defender XDR, KQL Q1 and Q2 list devices with the CVE and the affected software.
Work out what is reachable
For each vulnerable copy, ask whether untrusted Brotli data can reach it. Put internet-facing Node.js, Bun and Express APIs, ASP.NET Core with request decompression, Envoy with a Brotli decompressor, PHP apps using Guzzle and anything that fetches untrusted URLs at the top of the list.
Update, then restart
Install the fixed versions in the table above. Then restart every process that had the old library loaded, including Node.js, Bun, Python workers, IIS app pools, Envoy and PHP-FPM. Updating a shared libbrotli package does nothing for processes that are still running.
Rebuild bundled copies and leave end-of-life versions
Rebuild container images, self-contained .NET apps (republish NativeAOT apps) and Electron apps, and anything else that vendors Brotli. Move off Node.js 20 and older and unsupported .NET releases, because they get no fix.
Reduce exposure until every copy is fixed
Reject Brotli-compressed request bodies at the edge or WAF where your apps do not need them, disable ASP.NET Core Brotli request decompression, keep Brotli out of HttpClient automatic decompression for untrusted URLs and remove Envoy Brotli decompressor filters. These reduce exposure; they are not a fix.
# nginx: refuse Brotli-compressed request bodies where the app does not need them
if ($http_content_encoding ~* "br") { return 415; }Turn on the logs the hunts need
Collect the Windows Application log (events 1000 and 1026), Linux kernel and daemon syslog, and request headers on your proxy if you want to hunt for Brotli-encoded requests.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Find vulnerable copies of Brotli and hunt for signs of exploitation. Everything is read-only.
check-brotli.sh
Finds Node.js, Bun, .NET, PowerShell, Envoy, curl, libbrotli, the Python Brotli packages and bundled copies in folders you point it at, and compares each with the fixed versions. On Debian and Ubuntu it also checks the libbrotli1 package.
sudo ./check-brotli.sh
./check-brotli.sh --search-dir /srv/app --search-dir /opt
./check-brotli.sh --csv inventory.csvCheck-Brotli.ps1
The PowerShell 7 version, which also runs on Linux and macOS. It adds a check for the PHP for Windows rebuilds, which php -v cannot show, and finds self-contained .NET apps.
pwsh -File .\Check-Brotli.ps1
pwsh -File .\Check-Brotli.ps1 -SearchDir 'D:\Apps','C:\inetpub'
pwsh -File .\Check-Brotli.ps1 -CsvPath .\inventory.csvKQL hunts and Sigma rules
11 KQL queries for Microsoft Defender XDR and Sentinel: exposure from vulnerability management, runtimes spawning shells, crash and restart loops, rare outbound connections and Brotli-encoded requests where your proxy logs headers. 9 Sigma rules cover the same ground for other SIEM platforms.
Verdicts
- PATCHEDA fixed version, or a build that is not affected.
- LIKELY VULNERABLEA version in the affected range with no sign of a fix, or an end-of-life release with no fix.
- UNKNOWNThe version could not be read, or a distribution or vendor build may carry a backported fix.
Exit codes
| Code | Meaning |
|---|---|
| 0 | PATCHED |
| 1 | LIKELY VULNERABLE |
| 2 | UNKNOWN, or nothing found |
| 3 | Error, such as a bad argument or unreadable folder |
MSPs and internal IT teams can use the exit code in RMM or scheduled jobs to flag hosts at scale. The overall result is the worst verdict found.
Know the limits
- Both checkers are read-only. They read files and package metadata and only run known runtime binaries, such as node, dotnet and python, with a version flag.
- They check versions, they do not test for the flaw. Brotli built into appliances, browsers or closed-source apps is not found unless a recognisable file name or metadata is present.
- The KQL has not been run against a live tenant. Fields marked UNVERIFIED FIELD depend on your connectors, and the request header hunts need proxy logging most environments do not have.
- No indicators of compromise are included, because no primary source has published any.
Reactive: How to Hunt
No indicators have been published, so these hunts look for behaviour. Run them over the whole period each host was vulnerable and exposed, not just since you updated. CybaOps can run them across your estate or your clients'.
Runtimes spawning shells
Look for Node.js, Bun, Python, .NET, IIS worker or Envoy processes starting a shell or system tool (KQL Q3, Sigma shell rules). Treat a hit as a likely compromise.
Crash and restart loops
Memory corruption often shows up as crashes before it works. Look for repeated application errors, Windows Error Reporting events, segfaults in libbrotli and services that keep restarting (KQL Q4 to Q7).
New outbound connections
Look for those runtimes connecting to public destinations they do not normally reach, especially soon after a crash or an unusual request (KQL Q8).
Brotli-encoded requests
If your proxy logs request headers, look for Content-Encoding: br requests from unfamiliar sources, and match them to crashes in the same window (KQL Q9 to Q11).
If you find something
- Isolate the device in your EDR, such as Microsoft Defender for Endpoint, and collect an investigation package.
- Preserve process memory and core dumps if crashes were recorded.
- Rotate every secret the process could read, such as environment variables, connection strings, API keys and cloud credentials, because the flaw can disclose memory.
- Rebuild compromised hosts and containers from clean images rather than cleaning them in place.
Patched does not mean clean
Updating stops new exploitation but does not undo anything an attacker already did. Memory disclosure may already have leaked secrets, and code execution may have left persistence. On every host that ran a vulnerable decoder while exposed, run the hunts above and rotate the secrets those processes held.
Brotli CVE-2026-111497 FAQ
Short answers based on Google, CISA, NVD and vendor advisories as of 27 October 2026.
Is CVE-2026-111497 being exploited?
Yes, according to CISA, which added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. No primary source has published how it is being exploited, or any IP addresses, hashes or other indicators, so hunting has to rely on behaviour rather than a blocklist.
What are HTTP2Shell, Node2Shell and Broccoli2Shell?
They are nicknames for CVE-2026-111497 used in public research. Google, CISA and NVD only use the CVE number. All three names refer to the same Brotli decoder flaw.
How severe is it?
Google, as the CVE numbering authority, scores it CVSS 4.0 9.2 Critical. NVD has not scored it yet (Awaiting Analysis). Node.js rates it High and Microsoft gives it CVSS 3.1 8.1. Its listing in CISA's catalogue matters more than the exact score.
Are .NET and ASP.NET Core apps exposed?
Not by default. Microsoft says exposure needs ASP.NET Core request decompression handling Brotli, HttpClient automatic decompression that includes Brotli, or direct use of BrotliStream or BrotliDecoder. Update the runtime anyway, rebuild self-contained apps and republish NativeAOT apps. .NET Framework is not affected.
Is PHP affected?
On Windows, the official PHP builds include Brotli through the cURL extension and have been rebuilt with the fix. cURL only decompresses Brotli responses when automatic decompression is turned on. That is off by default, but HTTP client libraries can enable it, and Guzzle does by default.
Does updating the operating system package fix Node.js and Python?
Partly. On Debian, Node.js and brotlicffi use the system libbrotli, so updating libbrotli1 fixes them once the processes restart. Official Node.js downloads, Bun, Python wheels, container images, Electron apps and self-contained .NET apps carry their own copy and need their own update or rebuild.
Does the 10 November due date apply to UK organisations?
No. CISA's due date applies to US federal agencies under BOD 26-04. Treat the KEV listing as a strong signal to act now rather than as your deadline.
What should MSPs and internal IT teams do first?
Run the free checkers across every server and build agent you or your clients run, starting with internet-facing Node.js, Bun, Python and ASP.NET Core services and anything behind Envoy. Update, restart, rebuild bundled copies, then run the hunts over the whole period each host was exposed.
Find and Fix Vulnerable Libraries Across Your Estate
CybaOps monitors your endpoints, servers and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- CISA: Known Exploited Vulnerabilities catalogue (CVE-2026-111497 added 27 October 2026)
- Google Brotli: release v1.2.1, with fixes in 1.0.10, 1.1.1 and 1.2.1 (21 October 2026)
- NVD: CVE-2026-111497
- Node.js: October 2026 security releases
Related threat guides: PHP2Shell and LiteLLM supply chain attack. All threat guides.