Topic
CVE-2026-111497
CISA Adds Brotli and Adobe Commerce Flaws to Known Exploited Vulnerabilities Catalog
Vulnerabilities & Exploits
Windows PHP Updated to Patch Critical Brotli Vulnerability CVE-2026-111497
Vulnerabilities & Exploits
Critical CVE-2026-111497 Out-of-Bounds Write Flaw in Google Brotli Decoder Impacts Broad Range of Environments
Vulnerabilities & ExploitsGoogle Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy
A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.
Microsoft Issues Out-of-Band .NET Security Updates Fixing Brotli Buffer Overflow and Other Flaws
Microsoft has released out-of-band security updates for .NET 10, .NET 9, and .NET 8 to address multiple vulnerabilities. The patches cover two newly identified issues and complete remediation for two additional flaws that received incomplete fixes during the October 13 monthly update cycle. One critical vulnerability, CVE-2026-111497, affects the Brotli compression library and can lead to information disclosure, denial of service, or privilege escalation when processing crafted compressed data. A second issue, CVE-2026-114148, enables local privilege escalation in Linux distribution packages for ASP.NET Core due to improper ownership handling. Microsoft also reissued fixes for remote code execution vulnerabilities CVE-2026-70197 and CVE-2026-102870. Organizations are advised to apply the updates immediately, including rebuilding and redistributing applications in container or embedded environments.
Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Node.js published security updates on October 21, 2026 for the 26.x, 24.x and 22.x release lines. The patches address multiple high-severity vulnerabilities affecting TLS hostname validation and the Brotli decoder, along with updates to critical dependencies including OpenSSL and Undici. Several CVEs cover bypasses in certificate hostname checks when IP addresses use full-width digits or when hosts resolve loosely to IP addresses. A particularly serious out-of-bounds write in the Brotli decoder (CVE-2026-111497) could enable remote code execution on services processing compressed responses. Additional fixes resolve keep-alive socket timing issues, DNS resolution truncation with NUL characters, and entropy caching problems in crypto.randomUUID and randomInt functions. The releases also update c-ares, Undici, OpenSSL, SQLite and ca-cert bundles following the eMudhra intermediate CA compromise.
Node.js Addresses 10 Vulnerabilities Including High-Severity RCE Risk in Brotli Decompression
The Node.js development team disclosed ten vulnerabilities across multiple versions of the JavaScript runtime on October 21, 2026. Four of the issues received a High severity rating, with one carrying a remote code execution risk through improper handling of Brotli-compressed data. The flaw tracked as CVE-2026-111497 affects Node.js 26.x, 24.x, and 22.x branches and stems from out-of-bounds memory writes during decompression. Additional High-severity problems involve DNS name resolution truncation when NUL characters are present and hostname verification bypasses in TLS certificate validation. The project also resolved three Medium and three Low severity issues related to certificate validation, snapshot entropy reuse, and file-access permission checks. Updated releases Node.js 26.12.1, 24.22.1, and 22.23.4 incorporate fixes for both the core issues and vulnerabilities in bundled components such as c-ares, OpenSSL, SQLite, and Undici. Users of unsupported older branches are advised to migrate to currently maintained versions.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
Node.js Issues Security Updates Patching Ten Vulnerabilities Including High-Severity TLS Name Verification Bypasses
The Node.js project released security updates on October 21 for release lines 26, 24, and 22, addressing ten vulnerabilities with four rated high severity. The most critical issue, CVE-2026-111497, resides in the Brotli decoder and involves an out-of-bounds write that could enable remote code execution across all three supported lines. Two additional high-severity flaws affect TLS name verification: CVE-2026-105483 bypasses checks when addresses contain full-width digits, while CVE-2026-106069 fails on imprecise IP address resolution, potentially allowing a certificate to be accepted for an unintended destination. A fourth high-severity vulnerability, CVE-2026-105482, causes the dns.resolve function to truncate names containing null characters, creating inconsistencies between queried and resolved names. Medium-severity issues include out-of-order processing in HTTP socket keep-alive, improper certificate validation for non-standard IPv4 addresses, and repeated cryptographic random values in snapshot initialization and single-executable applications affecting crypto.randomUUID and crypto.randomInt. The updates also refresh c-ares, CA certificates, Undici, OpenSSL, and SQLite, with recommendations to test HTTPS outbound connections, DNS handling, Brotli-compressed content, and permission-restricted workloads.