Actively exploited · Published Oct 22, 2026 · Assigned by Google
CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder
Critical 9.2 Exploited
In plain English
A critical-severity out-of-bounds write in Brotli from Google. Attackers are actively exploiting it in the wild (listed by CISA on October 27, 2026). The chance it is exploited in the next 30 days is estimated at 82.6% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)82.6%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Oct 27, 2026
Attack tooling1Public PoC
CISA guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Federal agencies must remediate by Nov 10, 2026.
Official description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | aspnetcore-runtime-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | aspnetcore-runtime-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | aspnetcore-runtime-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | aspnetcore-runtime-dbg-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | aspnetcore-runtime-dbg-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | aspnetcore-runtime-dbg-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | aspnetcore-targeting-pack-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | aspnetcore-targeting-pack-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | aspnetcore-targeting-pack-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | brotli | 1.1.0-8.el10_2.1 | ALSA-2026:90449 |
| AlmaLinux:8 | brotli | 1.0.6-5.el8_10 | ALSA-2026:90501 |
| AlmaLinux:9 | brotli | 1.0.9-10.el9_8.1 | ALSA-2026:90495 |
| AlmaLinux:10 | brotli-devel | 1.1.0-8.el10_2.1 | ALSA-2026:90449 |
| AlmaLinux:8 | brotli-devel | 1.0.6-5.el8_10 | ALSA-2026:90501 |
| AlmaLinux:9 | brotli-devel | 1.0.9-10.el9_8.1 | ALSA-2026:90495 |
| AlmaLinux:10 | dotnet-apphost-pack-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-apphost-pack-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-apphost-pack-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-hostfxr-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-hostfxr-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-hostfxr-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-runtime-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-runtime-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-runtime-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-runtime-dbg-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-runtime-dbg-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-runtime-dbg-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-sdk-8.0 | 8.0.133-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-sdk-8.0 | 8.0.133-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-sdk-8.0 | 8.0.133-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-sdk-8.0-source-built-artifacts | 8.0.133-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.133-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.133-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-sdk-dbg-8.0 | 8.0.133-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-sdk-dbg-8.0 | 8.0.133-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-sdk-dbg-8.0 | 8.0.133-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-targeting-pack-8.0 | 8.0.33-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-targeting-pack-8.0 | 8.0.33-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-targeting-pack-8.0 | 8.0.33-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:10 | dotnet-templates-8.0 | 8.0.133-1.el10_2 | ALSA-2026:92428 |
| AlmaLinux:8 | dotnet-templates-8.0 | 8.0.133-1.el8_10 | ALSA-2026:92420 |
| AlmaLinux:9 | dotnet-templates-8.0 | 8.0.133-1.el9_8 | ALSA-2026:92492 |
| AlmaLinux:8 | firefox | 140.10.0-1.el8_10.alma.1 | ALSA-2026:10766 |
| AlmaLinux:10 | libbrotli | 1.1.0-8.el10_2.1 | ALSA-2026:90449 |
| AlmaLinux:9 | libbrotli | 1.0.9-10.el9_8.1 | ALSA-2026:90495 |
| AlmaLinux:8 | nodejs | 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-devel | 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-devel | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-docs | 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-docs | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-full-i18n | 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-full-i18n | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-libs | 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-libs | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:92378 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:92376 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:92378 |
| AlmaLinux:8 | npm | 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | npm | 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux:10 | python3-brotli | 1.1.0-8.el10_2.1 | ALSA-2026:90449 |
| AlmaLinux:8 | python3-brotli | 1.0.6-5.el8_10 | ALSA-2026:90501 |
| AlmaLinux:9 | python3-brotli | 1.0.9-10.el9_8.1 | ALSA-2026:90495 |
| AlmaLinux:8 | thunderbird | 140.10.0-1.el8_10.alma.1 | ALSA-2026:13537 |
| AlmaLinux:8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux:9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| Alpine:v3.21 | brotli | 1.1.1-r0 | ALPINE-CVE-2026-111497 |
| Alpine:v3.23 | brotli | 1.2.1-r0 | ALPINE-CVE-2026-111497 |
| Alpine:v3.24 | brotli | 1.2.1-r0 | ALPINE-CVE-2026-111497 |
| Alpine:v3.24 | nodejs-current | 26.12.1-r0 | ALPINE-CVE-2026-111497 |
| Debian:12 | brotli | 1.0.9-2+deb12u1 | DEBIAN-CVE-2026-111497 |
| Debian:13 | brotli | 1.1.0-2+deb13u1 | DEBIAN-CVE-2026-111497 |
| Debian:14 | brotli | 1.2.0-4.1 | DEBIAN-CVE-2026-111497 |
| Debian:12 | edk2 | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:13 | edk2 | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:14 | edk2 | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:12 | nodejs | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:13 | nodejs | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:14 | nodejs | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:13 | python-brotlicffi | no fix listed | DEBIAN-CVE-2026-111497 |
| Debian:14 | python-brotlicffi | 1.2.1.0+ds-1 | DEBIAN-CVE-2026-111497 |
| Go | github.com/andybalholm/brotli | 1.2.7 | GO-2026-6888 |
| PyPI | brotli | 1.2.1 | PYSEC-2026-4322 |
| PyPI | brotli | 1.2.1 | GHSA-9v8h-qqgm-4m35 |
| PyPI | brotlicffi | 1.2.1.0 | PYSEC-2026-4323 |
| PyPI | brotlicffi | 1.2.1.0 | GHSA-9v8h-qqgm-4m35 |
| Rocky Linux:10 | brotli | 0:1.1.0-8.el10_2.1 | RLSA-2026:90449 |
| Rocky Linux:8 | brotli | 0:1.0.6-5.el8_10 | RLSA-2026:90501 |
| Rocky Linux:9 | brotli | 0:1.0.9-10.el9_8.1 | RLSA-2026:90495 |
| Rocky Linux:10 | dotnet8.0 | 0:8.0.133-1.el10_2 | RLSA-2026:92428 |
| Rocky Linux:8 | dotnet8.0 | 0:8.0.133-1.el8_10 | RLSA-2026:92420 |
| Rocky Linux:9 | dotnet8.0 | 0:8.0.133-1.el9_8 | RLSA-2026:92492 |
| Rocky Linux:9 | nodejs | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95 | RLSA-2026:92378 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:92376 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+40278+50b003a3 | RLSA-2026:92376 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+40281+14cc6568 | RLSA-2026:92378 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:92376 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40171+8fa9c325 | RLSA-2026:92376 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40172+38f6fdd1 | RLSA-2026:92376 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:92378 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 | RLSA-2026:92378 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+40164+8921ab53 | RLSA-2026:92378 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 | RLSA-2026:92378 |
| Ubuntu:22.04:LTS | brotli | 1.0.9-2ubuntu0.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:22.04:LTS | brotli | 1.0.9-2ubuntu0.1 | USN-8956-1 |
| Ubuntu:24.04:LTS | brotli | 1.1.0-2ubuntu0.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:24.04:LTS | brotli | 1.1.0-2ubuntu0.1 | USN-8956-1 |
| Ubuntu:26.04:LTS | brotli | 1.2.0-3ubuntu0.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:26.04:LTS | brotli | 1.2.0-3ubuntu0.1 | USN-8956-1 |
| Ubuntu:26.10 | brotli | 1.2.0-4ubuntu0.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:26.10 | brotli | 1.2.0-4ubuntu0.1 | USN-8956-1 |
| Ubuntu:24.04:LTS | dotnet10 | 10.0.114-10.0.14-0ubuntu1~24.04.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:24.04:LTS | dotnet10 | 10.0.114-10.0.14-0ubuntu1~24.04.1 | USN-8958-1 |
| Ubuntu:26.04:LTS | dotnet10 | 10.0.114-10.0.14-0ubuntu1~26.04.1 | USN-8958-1 |
| Ubuntu:26.04:LTS | dotnet10 | 10.0.114-10.0.14-0ubuntu1~26.04.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:26.10 | dotnet10 | 10.0.114-10.0.14-0ubuntu1~26.10.1 | USN-8958-1 |
| Ubuntu:26.10 | dotnet10 | 10.0.114-10.0.14-0ubuntu1~26.10.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:26.10 | dotnet11 | 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1 | USN-8958-1 |
| Ubuntu:26.10 | dotnet11 | 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:22.04:LTS | dotnet6 | no fix listed | UBUNTU-CVE-2026-111497 |
| Ubuntu:22.04:LTS | dotnet7 | no fix listed | UBUNTU-CVE-2026-111497 |
| Ubuntu:22.04:LTS | dotnet8 | 8.0.133-8.0.33-0ubuntu1~22.04.1 | USN-8958-1 |
| Ubuntu:22.04:LTS | dotnet8 | 8.0.133-8.0.33-0ubuntu1~22.04.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:24.04:LTS | dotnet8 | 8.0.133-8.0.33-0ubuntu1~24.04.1 | UBUNTU-CVE-2026-111497 |
| Ubuntu:24.04:LTS | dotnet8 | 8.0.133-8.0.33-0ubuntu1~24.04.1 | USN-8958-1 |
Affected products (as reported)
Weakness: CWE-787, CWE-252 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high patch
- https://github.com/andybalholm/brotli/releases/tag/v1.2.7 release-notes, third-party-advisory
- https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 government-resource
- https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- http://www.openwall.com/lists/oss-security/2026/10/23/25
- https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html
- http://www.openwall.com/lists/oss-security/2026/10/24/6
- http://www.openwall.com/lists/oss-security/2026/10/26/12
- http://www.openwall.com/lists/oss-security/2026/10/26/13
- https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
- https://broccoli2shell.com
- https://github.com/dotnet/announcements/issues/494
- https://github.com/google/brotli/releases/tag/v1.2.1
- https://github.com/google/brotli/releases/tag/v1.1.1
- https://github.com/google/brotli/releases/tag/v1.0.10
- https://patchtheplanet.org/brotli
- http://www.openwall.com/lists/oss-security/2026/10/26/16
- http://www.openwall.com/lists/oss-security/2026/11/03/2
- https://cert-portal.siemens.com/productcert/html/ssa-898633.html
- https://cert-portal.siemens.com/productcert/html/ssa-443410.html
- https://cert-portal.siemens.com/productcert/html/ssa-045512.html