{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-111497",
  "revision": 1,
  "title": "Broccoli2Shell — Out-of-Bounds Write in the Google Brotli Decoder",
  "subtitle": "Brotli decoder out-of-bounds write",
  "summary": "An out-of-bounds write in the Google Brotli decoder lets crafted compressed data corrupt memory, causing a crash, memory disclosure or RCE. The decoder sits inside Node.js, Bun, PowerShell 7, Envoy, Istio and many other products, and attackers are exploiting it.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "cvss_vendor": {
    "score": 9.2,
    "version": "4.0",
    "source": "https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/",
    "as_of": "2026-11-04"
  },
  "epss": 0.82641,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "exploit_override": {
      "source": "https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/",
      "as_of": "2026-11-04",
      "note": "Proof-of-concept exploits are on GitHub, and Imperva demonstrated remote code execution."
    },
    "attack_complexity": "low",
    "kev_added": "2026-10-27",
    "kev_due": "2026-11-10",
    "prerequisites": "The ability to supply crafted Brotli data that an application decompresses with an affected decoder."
  },
  "aliases": [
    "Broccoli2Shell",
    "HTTP2Shell",
    "Node2Shell",
    "Brotli2Shell"
  ],
  "affected": [
    "Google Brotli 1.0.3 to before 1.0.10",
    "Google Brotli 1.1.0 to before 1.1.1",
    "Google Brotli 1.2.0 to before 1.2.1",
    "Node.js 22.x, 24.x and 26.x",
    "Node.js 20, 23 and 25 (end of life, unfixed)",
    "Bun",
    ".NET",
    "PowerShell 7",
    "Envoy",
    "Istio",
    "Python brotli and brotlicffi",
    "brotli4j",
    "FFmpeg",
    "Apache Arrow",
    "ClickHouse",
    "Chromium and Electron",
    "Git for Windows",
    "PHP Windows builds",
    "Linux distribution packages"
  ],
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "Brotli 1.2.1",
      "Brotli 1.1.1",
      "Brotli 1.0.10",
      "Node.js 26.12.1",
      "Node.js 24.22.1",
      "Node.js 22.23.4",
      ".NET 10.0.14",
      ".NET 9.0.22",
      ".NET 8.0.33"
    ]
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Update Brotli and every product that bundles it to a fixed release, rebuild containers and bundled applications, then redeploy and restart services.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-111497",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "exploitation.exploit_available",
        "exploitation.exploit_override"
      ],
      "source": "https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "cvss_vendor"
      ],
      "source": "https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "source": "https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "source": "https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "source": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "source": "https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "writeup",
      "url": "https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/"
    },
    {
      "type": "writeup",
      "url": "https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/"
    },
    {
      "type": "vendor_advisory",
      "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers"
    },
    {
      "type": "writeup",
      "url": "https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/"
    }
  ],
  "published_at": "2026-10-22T14:17:37.190Z",
  "issued_at": "2026-11-04T14:36:49.943Z",
  "tags": [
    "brotli",
    "broccoli2shell",
    "node2shell",
    "supply-chain",
    "out-of-bounds-write"
  ]
}