Brotli flaw triggers security updates across major software

A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and nicknamed Node2Shell, has prompted security updates across Microsoft, Node.js, and two Python packages. The flaw is an out-of-bounds write in the Brotli decoder that affects Brotli 1.0.3 through 1.2.0, with Google assigning a CVSS v4 score of 9.2 (critical). The Node.js project and Python package maintainers have patched their releases, while Microsoft issued fixes for .NET, Visual Studio and PowerShell on 25 October 2026.

Brotli versions 1.0.10, 1.1.1 and 1.2.1 contain the fix, and other affected projects such as Bun, Envoy and Istio have updated as well. The vulnerability can allow memory corruption, potential crashes or memory leakage, and could enable an unauthenticated attacker to execute arbitrary code if malicious Brotli data reaches the decoder.

OpenAI’s Codex Security researchers credited the discovery, noting the issue emerged during red‑teaming work and was reported to Brotli developers and dependent projects. Imperva demonstrated exploitability on the official Node.js 24.22.0 image for Linux arm64, with proof-of-concept inputs delivered via server responses and request bodies processed by Express 5 or body-parser 2; the firm has not publicised its exploit.

Microsoft’s updates cover .NET runtime versions 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3, Visual Studio 2019, 2022 and 2026, and PowerShell 7.4–7.6. In Python, the vulnerable decoders are in Brotli and brotlicffi, patched to 1.2.1 and 1.2.1.0 respectively. A public tracker lists other unpatched projects still exposed to the Brotli decoder, and applying the updates requires restarting services and rebuilding container images.