THE BASE COLLECTIONCRDS / 0.1

CVE-2026-111497CRITICAL

Broccoli2Shell

Brotli decoder out-of-bounds write

KNOWN EXPLOITED

initial accessT1190

An out-of-bounds write in the Google Brotli decoder lets crafted compressed data corrupt memory, causing a crash, memory disclosure or RCE. The decoder sits inside Node.js, Bun, PowerShell 7, Envoy, Istio and many other products, and attackers are exploiting it.

CVSS 3.1

9.8

EPSS

82.6%

PATCH

1.2.1

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

SCRTY:CRDS / BASE SETREV. 01 ◆

Raw JSON

One vulnerability. The facts that matter.
A clear next move.

critical Known exploitedREV. 01

CVE-2026-111497Broccoli2Shell — Out-of-Bounds Write in the Google Brotli Decoder

YOUR NEXT MOVE

Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.

Read the risk

THE VITAL STATS

CVSS score: 9.8/ 10
EPSS probability: 82.6%
Attack complexity: Low
Vendor score: 9.2 (CVSS 4.0), source as of 2026-11-04
Known exploited: Yes — CISA KEV
CVE published: 2026-10-22
Added to KEV: 2026-10-27
CISA due date: 2026-11-10
Exploit published: Yes
Confidence: high
Kill chain: initial access
MITRE ATT&CK: T1190
Severity: critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Public exploitYes, from a curated source as of 2026-11-04; the NVD record carries no exploit tag. Proof-of-concept exploits are on GitHub, and Imperva demonstrated remote code execution.

Also known asBroccoli2Shell, HTTP2Shell, Node2Shell, Brotli2Shell

AffectedGoogle Brotli 1.0.3 to before 1.0.10, Google Brotli 1.1.0 to before 1.1.1, Google Brotli 1.2.0 to before 1.2.1, Node.js 22.x, 24.x and 26.x, Node.js 20, 23 and 25 (end of life, unfixed), Bun, .NET, PowerShell 7, Envoy, Istio, Python brotli and brotlicffi, brotli4j, FFmpeg, Apache Arrow, ClickHouse, Chromium and Electron, Git for Windows, PHP Windows builds, Linux distribution packages

Attacker needsThe ability to supply crafted Brotli data that an application decompresses with an affected decoder.

Fixed inBrotli 1.2.1, Brotli 1.1.1, Brotli 1.0.10, Node.js 26.12.1, Node.js 24.22.1, Node.js 22.23.4, .NET 10.0.14, .NET 9.0.22, .NET 8.0.33

Behind the card

6 REFERENCES

Field-level provenanceTRACE THE SOURCES +

Which source supports each field, when it was retrieved, and who extracted it.

Fields	Source	Retrieved	Extractor	Confidence
cvss, exploitation.attack_complexity, published_at, references	nvd.nist.gov	2026-11-04	scrty-crds-pipeline/0.1	high
exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due	cisa.gov	2026-11-04	scrty-crds-pipeline/0.1	high
epss	api.first.org	2026-11-04	scrty-crds-pipeline/0.1	high
title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites	nvd.nist.gov	2026-11-04	claude-code	high
exploitation.exploit_available, exploitation.exploit_override	helpnetsecurity.com	2026-11-04	human	high
cvss_vendor	rapid7.com	2026-11-04	human	high
aliases, affected	rapid7.com	2026-11-04	human	high
remediation	rapid7.com	2026-11-04	claude-code	high
aliases, affected	helpnetsecurity.com	2026-11-04	human	high
remediation	helpnetsecurity.com	2026-11-04	claude-code	high
aliases, affected	microsoft.com	2026-11-04	human	high
remediation	microsoft.com	2026-11-04	claude-code	high
aliases, affected	bleepingcomputer.com	2026-11-04	human	high
remediation	bleepingcomputer.com	2026-11-04	claude-code	high

Printing history

THE RECORD

r12026-11-04Initial base card

First printing. This card has not been reprinted since publication.