CVE-2026-111497 in Google's Brotli compression library affects everything from Node.js to .NET and has been added to CISA's catalogue of exploited vulnerabilities.
A critical flaw in the decoder of Brotli, Google's compression library, was publicly disclosed by the Node.js team on 21 October 2026. Tracked as CVE-2026-111497, it circulates among researchers under the names "Brotli2Shell", "Node2Shell" and "Broccoli2Shell".
The bug is an out-of-bounds write. When an application decompresses Brotli data crafted by an attacker, process memory can leak, the process can crash, or code can be executed remotely with the privileges of the application. Google, acting as the CVE numbering authority, scored it 9.2 on CVSS v4.0; Microsoft rated the .NET impact 8.1 on CVSS v3.1 (Tenable).
Why the blast radius is so wide
Brotli is one of the invisible plumbing pieces of the modern web. Because it compresses HTTP responses, a long list of runtimes and libraries ship a copy of it. Products that have published fixes include Node.js (22.23.4, 24.22.1, 26.12.1), Microsoft .NET 8/9/10/11, Bun, Envoy Proxy, Istio, the Python Brotli and brotlicffi packages, and PHP builds for Windows. Node.js 20, 23 and 25 are past end of support and will not receive a fix at all.
According to scanning by cloud security firm Wiz, 91% of the cloud environments it examined contain at least one resource affected by the flaw. The US cyber agency CISA added it to the Known Exploited Vulnerabilities catalogue on 27 October 2026, setting 10 November as the remediation deadline for federal agencies. Singapore's Cyber Security Agency issued its own patch-immediately alert on 30 October.
How easy the flaw is to weaponise deserves a calmer reading. Tenable reports that threat intelligence firm ELLIO observed an exploitation attempt on 26 October against Node.js 24.22.0, but that most laboratory attempts ended in a crashed worker process rather than a shell. On the other hand, public proof-of-concept code is already circulating on GitHub, so waiting is not a strategy that buys time.
What it means for a small or mid-sized business
The flaw is probably not in code your team wrote. The risk arrives inside the products you bought: the web layer of your e-commerce platform, your ERP or accounting front end, your customer portal, your API gateway, even an application a supplier installed for you. For a construction office, a shipping agency or a logistics firm that outsources server management, the question is simple: which of my internet-facing applications run on Node.js or .NET, and on which versions?
The second point matters just as much. Installing the patch is not the end of the job. The fix only takes effect once the process restarts, container images have to be rebuilt and redeployed, and any application that bundles its own copy of Brotli needs updating separately.
What Kamer Bilişim recommends
- Build an inventory, starting at the internet-facing edge. List the Node.js and .NET versions running on your web servers, API endpoints and customer portals. A system whose version nobody knows is a system that cannot be patched.
- Patch, then genuinely restart the service. Move Node.js to 22.23.4, 24.22.1 or 26.12.1 and .NET to 8.0.33, 9.0.22 or 10.0.14, then restart the application process and confirm the patched component is actually loaded. In container environments, rebuild the image.
- Apply interim controls where a patch is still pending. Reject requests carrying the Content-Encoding: br header at the reverse proxy or load balancer, and disable Brotli decoding in HTTP clients. These narrow the window; they do not replace the patch.
If you would like help building a server inventory, putting a patch plan on the calendar or reviewing your internet-facing services, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Tenable Research — "Brotli2Shell: Frequently Asked Questions for Google Brotli Decoder (CVE-2026-111497)"; Singapore Cyber Security Agency (CSA) AL-2026-154; Wiz security advisory; CISA Known Exploited Vulnerabilities catalogue.
Source: Tenable Research