CVE-2026-111497: exploited Brotli flaw, patch Node.js, .NET and Envoy now

Summary. CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, affecting Brotli 1.0.3 through 1.2.0. NVD scores it 9.8 under CVSS 3.1, and Google, as the CVE numbering authority, scores it 9.2 under CVSS 4.0. CISA added it to the Known Exploited Vulnerabilities (KEV) catalogue on 27 October 2026 with a federal due date of 10 November 2026, which has now passed. Google released Brotli 1.0.10, 1.1.1 and 1.2.1 on 21 October, and Node.js shipped 22.23.4, 24.22.1 and 26.12.1 in its security release of the same date. Envoy had already shipped fixed builds in early October and published its advisory on 23 October; Istio fixed it in 1.29.9, 1.30.6 and 1.31.2. Microsoft released .NET 8.0.33, 9.0.22 and 10.0.14 on 25 October. Apple patched its copy on 9 November across iOS, iPadOS, macOS, watchOS and visionOS. Exposure needs decompression of Brotli data an attacker controls, which .NET does not do by default. The hard part is finding embedded copies in containers, self-contained apps and static binaries. Our advice: patch internet-facing services and proxies that decompress Brotli first, rebuild images, then sweep SBOMs and binaries for the rest.

About this article. For platform, DevOps and security teams running Node.js, .NET, Envoy, Istio, Python or Go services. Versions and dates were checked on 11 November 2026 against the NVD and CVE.org records, the CISA KEV feed, Google's Brotli releases, the Node.js, Microsoft, Envoy, Istio and Apple advisories, and the Ubuntu and Debian trackers. This article gives defensive guidance only and is not legal advice; vendors keep publishing fixes, so confirm against each advisory. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

This guide answers one question: which software is affected by CVE-2026-111497, and which versions fix it. If you run Alpine hosts or containers with sshd, the other KEV entry in this cycle needs separate attention; see our guide to the OpenSSH CVE-2026-123158 Alpine password bypass.

What happened, in dates

Brotli is a compression format used for HTTP content encoding, web fonts and data files. Most teams never install it directly: it arrives inside a runtime (Node.js, .NET, Bun), a proxy (Envoy, and therefore Istio), a language package (Python, Go) or an operating system library. The dates below come from the vendor records cited in this article.

The press calls the bug Node2Shell, and BleepingComputer also lists Broccoli2Shell and HTTP2Shell as names for the same CVE. Siemens and the GitHub advisory for the Python packages use Node2Shell. Node.js credits OpenAI Codex Security researchers for the report, and Envoy credits OpenAI Security Research. CISA's KEV entry names no threat actor and lists ransomware use as unknown.

What the flaw is, in defensive terms

The Node.js advisory gives the clearest vendor description. When the decoder met an invalid block switch, it reported a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input to an eight-byte internal buffer and wrote past its end. NVD's description says a crafted Brotli stream lets a remote, unauthenticated attacker corrupt decoder memory, disclose memory contents, cause a denial of service or potentially run code. NVD classes it as CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value), and CISA's KEV entry names it as an unchecked return value vulnerability.

The trigger is decompression. Compressing data with Brotli is not the risk. An application is exposed when it decodes Brotli data that someone outside your trust boundary can supply. The common paths are:

• Inbound requests with Content-Encoding: br that a server or proxy decompresses before your code sees the body.

• Outbound responses that an HTTP client decompresses automatically, for example when you fetch webhooks, crawl pages or call third-party APIs.

• Files and messages such as uploads, queued payloads, data lake files or fonts that your code passes through a Brotli decoder.

Scores differ by vendor because exposure differs. NVD rates the library 9.8. Microsoft rates the .NET impact 8.1 with high attack complexity, because .NET only decodes Brotli when an application turns that on. Node.js rates its issue High. Ubuntu gives the CVE High priority and names the KEV listing as the reason. CISA's own assessment marks exploitation as active and the technical impact as total.

Fixed versions by product

Map what you run to the first release that fixes it, using the advisories cited in the sections below. Where a vendor backports, the package version can look older than the upstream fix, so check the advisory rather than the number alone.

Node.js: official binaries versus distribution builds

The official Node.js binaries, the node images on Docker Hub and most version managers bundle their own Brotli. For those, the Node.js version is the test: anything below 22.23.4, 24.22.1 or 26.12.1 on its line is vulnerable. The Node.js fix is a change to its own zlib binding rather than a Brotli library upgrade, so judge official builds by the Node.js release number. On 11 November the newest builds on each line were 22.23.4, 24.22.2 and 26.13.0, and Node.js 26 became the Active LTS line on 28 October.

Distribution packages can be different. Ubuntu notes that its nodejs packages on 22.04 and later link the system Brotli library, so patching libbrotli fixes them, while the 20.04 package uses a vendored copy and is marked vulnerable. Debian makes the same point for nodejs and python-brotlicffi. If you installed Node from your distribution, patch the distribution's brotli package and restart the process.

Two caveats. Node.js 20 reached end of life on 30 April 2026 and gets no fix. And Node.js pre-announced another security release for 11 November 2026 across 22.x, 24.x and 26.x, with a highest severity of High; once it is out, move to it rather than stopping at the October builds. Our Node.js security release playbook covers the rollout mechanics, and teams still on 22.x should read our Node.js 22 end-of-life guide, because that line stops receiving fixes on 30 April 2027.

.NET: exposed only when Brotli decompression is on

Microsoft's advisory is precise about exposure. ASP.NET Core request decompression and HttpClient automatic response decompression are off by default, so installing an affected runtime does not by itself expose an application. You are exposed if your code does any of these with attacker-controlled data:

• Enables ASP.NET Core request decompression with the br provider.

• Sets AutomaticDecompression on HttpClientHandler or SocketsHttpHandler to include DecompressionMethods.Brotli or DecompressionMethods.All.

• Calls BrotliStream or BrotliDecoder in System.IO.Compression directly.

The fix is the runtime: 8.0.33, 9.0.22 or 10.0.14, or SDK 8.0.133 or 8.0.427, 9.0.123 or 9.0.320, 10.0.114 or 10.0.403. Restart apps after installing it. Self-contained apps carry their own runtime and must be rebuilt and redeployed. NativeAOT apps link the decoder into the executable, so update the SDK and any explicit compiler or runtime-pack references, then republish; Microsoft warns that updating the shared runtime does not replace a decoder already linked into a NativeAOT binary.

Two things changed on 10 November. Microsoft shipped 8.0.34, 9.0.23 and 10.0.15 with further security fixes, and released .NET 11.0.0. The same day, .NET 8 and .NET 9 reached end of support, so 8.0.34 and 9.0.23 are their final updates. Patch to the latest build now, then plan the move to .NET 10 or 11 with our .NET 8 and 9 end-of-support guide.

Envoy and Istio: only if you decompress Brotli

Envoy's advisory says deployments are affected when the Brotli decompressor is configured. The decompressor is the envoy.compression.brotli.decompressor extension; the Brotli compressor, used to compress responses, is separate. Check which one your configuration loads, then upgrade. The fixed builds 1.36.12, 1.37.8, 1.38.6 and 1.39.3 were released on 6 October, 17 days before the advisory went public, and 1.40.0 on 13 October. Newer patches on each line followed on 26 and 27 October for unrelated issues, so take the latest build on your line.

Istio bundles Envoy in its sidecars and gateways. Its 15 October bulletin tells users who enable Brotli decompression, for example through an EnvoyFilter, to upgrade to 1.31.2, 1.30.6 or 1.29.9; 1.29 reached end of life on 15 October. The same bulletin fixes an AuthorizationPolicy bypass over HTTP/2 and an istiod denial of service, so upgrade even if you never decompress Brotli. Two later bulletins raise the floor again: ISTIO-SECURITY-2026-008 on 21 October (1.31.3, 1.30.7, and an exceptional 1.29.10) and ISTIO-SECURITY-2026-009 on 6 November (1.31.4 and 1.30.8). Istio 1.32.0 followed on 9 November.

Python, Go, Bun and data tools

The GitHub advisory GHSA-9v8h-qqgm-4m35 covers the PyPI brotli package before 1.2.1 and brotlicffi before 1.2.1.0. Python HTTP clients that support br content encoding usually rely on one of these, so a vulnerable wheel in a scraper or API client is a realistic path. In Go, NVD lists github.com/andybalholm/brotli before 1.2.7; the 1.2.7 tag ports the upstream fix. Go compiles dependencies into the binary, so the fix means rebuilding with the new module, not updating a shared library. NVD lists Bun before 1.4.4, and Bun's 1.4.4 release notes include Brotli among the areas covered by its security fixes.

NVD also lists ClickHouse up to 26.10.2.103, DuckDB up to 2.0.0 and Apache Arrow up to 26.0.0 as affected configurations. These are often fed files from outside the organisation, which matters more than whether they face the internet.

Linux distributions and Apple devices

Ubuntu has fixed brotli packages for 26.10 (1.2.0-4ubuntu0.1), 26.04 LTS (1.2.0-3ubuntu0.1), 24.04 LTS (1.1.0-2ubuntu0.1) and 22.04 LTS (1.0.9-2ubuntu0.1), with 20.04, 18.04 and 16.04 covered through Ubuntu Pro. Debian fixed bookworm in 1.0.9-2+deb12u1 and trixie in 1.1.0-2+deb13u1. These are backports: the package keeps an old upstream number with the fix applied.

Apple's 9 November updates fix the Brotli flaw in iOS and iPadOS 27.2.1 and 26.7.3, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1; Apple describes it as memory corruption from processing maliciously crafted input. The iOS 18.7.12 note does not list this CVE. Push the updates through your device management if you manage company Apple devices.

How to find embedded copies

Brotli hides well. A runtime update on the host does nothing for a container that bundles its own Node.js, a self-contained .NET app or a Go binary built in September. Work through three layers: SBOMs, image scans, and the binaries scanners miss.

Start with SBOMs

If your pipeline already produces CycloneDX or SPDX software bills of materials, query them first. Search for components named brotli, libbrotli, brotlicffi and andybalholm/brotli, and for the runtimes that bundle the decoder: node, the .NET runtime packs, envoy and bun. SBOMs give a fleet-wide answer quickly and show which repositories own each image.

Scan images and registries

Generate or refresh SBOMs from the images actually deployed, not just from source repositories, then match them against current vulnerability data. With open-source tools the pattern looks like this:

            # Build an SBOM from a deployed image, then match it against vulnerability data
syft registry.example.com/app:prod -o cyclonedx-json > app-sbom.json
grype sbom:./app-sbom.json | grep CVE-2026-111497

# Or scan the image directly
trivy image --scanners vuln registry.example.com/app:prod | grep CVE-2026-111497
          

Update the scanner's vulnerability database first; data from before 22 October will not know the CVE. Scan your registry, not just CI, because old tags keep running in production long after the pipeline moved on.

Check hosts and binaries scanners can miss

Scanners read package databases and language manifests, so they can miss statically linked copies and anything copied into an image without a package manager. These checks fill the gap:

            # OS packages
dpkg -l | grep -i brotli          # Debian, Ubuntu
rpm -qa | grep -i brotli          # RHEL, Fedora, SUSE
apk info -v | grep -i brotli      # Alpine

# Runtimes that bundle a decoder
node -v
dotnet --list-runtimes
envoy --version

# Language packages and compiled Go binaries
pip list 2>/dev/null | grep -i brotli
go version -m ./your-binary | grep andybalholm/brotli

# Shared library files on disk
find / -name 'libbrotli*' 2>/dev/null
          

For vendor software and appliances, ask the vendor whether the product embeds Brotli and which advisory covers it, and record each answer as evidence.

Find where your code decompresses Brotli

Exposure needs a decompression path, so search application code and configuration for it. In .NET look for AddRequestDecompression, DecompressionMethods.Brotli, DecompressionMethods.All, BrotliStream and BrotliDecoder. In Node.js look for createBrotliDecompress, brotliDecompress and brotliDecompressSync, and check whether your HTTP client libraries decode br responses for you. In Envoy look for the envoy.compression.brotli.decompressor extension, and in Istio search EnvoyFilter resources for Brotli. A service that decompresses untrusted Brotli goes to the top of the list.

The patch plan

The 10 November due date binds US federal civilian agencies, but CISA tells every organisation to use the KEV catalogue as an input to its patch prioritisation. The federal window, 14 days from listing, is a reasonable benchmark for the whole estate. If you are already past it, close the gap this week.

Five rules make the plan stick:

1. Restart after patching. A patched library on disk does nothing until the process using it restarts. Microsoft says this explicitly for .NET, and the same applies to Node.js, Envoy and anything linking libbrotli.

1. Rebuild images, do not just restart containers. Restarting an old container restarts the old binary. Rebuild from a patched base, pin the fixed version and redeploy.

1. Republish self-contained and NativeAOT .NET apps. A host runtime update does not reach them.

1. Retire old tags and ReplicaSets. Confirm nothing still serves traffic from images built before the fixes.

1. Gate the fix in CI. Fail builds that pin a vulnerable Node.js, .NET, Envoy or Brotli version, so the next rebuild of an old branch does not bring it back.

If you cannot patch today

Updating is the fix. These measures reduce exposure meanwhile:

• Turn off Brotli decompression you do not need. In ASP.NET Core, remove the br provider from your existing request decompression configuration. For HttpClient, change existing AutomaticDecompression flags so they exclude Brotli. Microsoft warns not to add decompression settings where none exist, because enabling decompression has its own denial-of-service risks.

• Remove the Brotli decompressor from Envoy and Istio configurations until the proxy is upgraded.

• Stop passing untrusted Brotli data to decoders. Microsoft asks applications that call Brotli APIs directly to stop doing so with untrusted data until patched, and to make sure no other code path decodes the same data.

• Filter at the edge. BleepingComputer's report on the KEV listing advises blocking inbound Brotli-compressed requests at the proxy or firewall where you do not need them. This protects request decompression only; it does nothing for clients that decode Brotli responses.

• Watch for crashes. A decoder crash in a process that handles untrusted input deserves investigation, not just an automatic restart.

Review any service that decompressed attacker-controlled Brotli while unpatched: check for unexpected child processes, outbound connections and new files, and rotate secrets if anything is unexplained.

Worked example: sizing the job

Take an illustrative estate, not a measured one: 60 container images in production, of which 34 run Node.js, 14 run .NET, 6 are Python services, 4 are Go services and 2 are Envoy-based gateways (34 + 14 + 6 + 4 + 2 = 60). Each image deploys to 3 environments (development, staging, production).

• Total rebuilds: 60 images × 3 environments = 180 deployments.

• If CI rebuilds automatically and each deployment needs 15 minutes of human checking, that is 180 × 15 = 2,700 minutes, or 45 engineer-hours.

• Suppose 12 images are internet-facing and decompress untrusted Brotli. Patching those first, in production and staging only, is 12 × 2 = 24 deployments, or 24 × 15 = 360 minutes: 6 engineer-hours on day one.

• The remaining 180 − 24 = 156 deployments take 156 × 15 = 2,340 minutes, or 39 engineer-hours: about one engineer for five 8-hour working days.

Prioritising by decompression path means one day of focused work covers the services most likely to be attacked.

India, EU and US notes

India. Indian SaaS, fintech and GCC teams running Node.js and .NET services should treat a KEV-listed runtime flaw as a same-week change. If you find signs of compromise, remember that CERT-In Directions No. 20(3)/2022-CERT-In of 28 April 2022 require listed incident types, including attacks on applications, to be reported to CERT-In within 6 hours of noticing them. Check your contractual breach-notice terms too.

EU. Since 11 September 2026, Article 14 of the Cyber Resilience Act has required manufacturers of products with digital elements to notify actively exploited vulnerabilities in their products through the single reporting platform, starting with an early warning within 24 hours. A product sold in the EU that embeds a vulnerable Brotli may fall under that duty; see our guide to CRA vulnerability reporting and take legal advice on your case.

US. The 10 November due date comes from BOD 26-04, which binds federal civilian executive branch agencies. It does not apply to contractors unless their procurement contract says so, but agencies must review contracts for the changes they need, so suppliers should expect questions.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can run a Brotli exposure sweep across your SBOMs, registries and hosts, rank services by decompression path, and plan restarts and image rebuilds with your engineers. Talk to us at /contact-us/.

Last updated: 11 November 2026.

References

1. CVE-2026-111497 record, NVD API 2.0 (last modified 10 November 2026) — NIST National Vulnerability Database

1. Known Exploited Vulnerabilities Catalog, JSON feed version 2026.11.10 — CISA

1. Brotli release v1.2.1, 21 October 2026 — Google on GitHub

1. Wednesday, October 21, 2026 Security Releases — Node.js

1. GHSA-3wvj-j6qm-62mr, Out-of-Bounds Write in Brotli Decompressor, 23 October 2026 — Envoy on GitHub

1. ISTIO-SECURITY-2026-007, 15 October 2026 — Istio

1. Microsoft Security Advisory CVE-2026-111497, .NET Brotli Decoder Out-of-bounds Write Vulnerability, 25 October 2026 — dotnet/announcements on GitHub

1. Apple security releases — Apple Support

1. CISA warns of hackers now exploiting critical Node2Shell flaw, 28 October 2026 — BleepingComputer

1. SSA-045512: Node2Shell Vulnerability in Siemens Products, 30 October 2026 — Siemens ProductCERT

1. GHSA-9v8h-qqgm-4m35, Brotli out-of-bounds write also affects the PyPI Brotli package — GitHub Advisory Database

1. CVE-2026-111497 — Ubuntu Security

1. CVE-2026-111497 record with CISA ADP Vulnrichment — CVE Program

1. src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (CVE-2026-111497) — Node.js on GitHub

1. CVE-2026-111497 — Debian security tracker

1. Node.js release index (index.json) — Node.js

1. Node.js release schedule (schedule.json) — Node.js Release Working Group

1. Wednesday, November 11, 2026 Security Releases (pre-announcement) — Node.js

1. .NET release index (releases-index.json) — Microsoft

1. .NET 8.0 release metadata (releases.json) — Microsoft

1. Brotli decompressor extension (envoy.compression.brotli.decompressor) — Envoy documentation

1. Envoy v1.39.3 release notes — Envoy on GitHub

1. ISTIO-SECURITY-2026-008, 21 October 2026 — Istio

1. ISTIO-SECURITY-2026-009, 6 November 2026 — Istio

1. Istio news: Announcing Istio 1.32.0, 9 November 2026 — Istio

1. andybalholm/brotli v1.2.7: Detect and report invalid stream earlier — GitHub

1. Bun v1.4.4 — Bun blog

1. About the security content of iOS 27.2.1 and iPadOS 27.2.1, 9 November 2026 — Apple Support

1. About the security content of macOS Golden Gate 27.2.1, 9 November 2026 — Apple Support

1. Known Exploited Vulnerabilities Catalog — CISA

1. Directions under sub-section (6) of section 70B of the IT Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022 — CERT-In

1. Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 14 and 71 — EUR-Lex

1. BOD 26-04: Prioritizing Security Updates Based on Risk, 10 June 2026 — CISA