Threat intelExploitedCVE-2026-111497CVSS 9.21 min read
Check Point Research says the Brotli decompression bug, first tied to Node.js, may also reach Python packages, .NET and proxies, and that scanning and exploitation attempts are already showing up.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.21 min read
The bug, nicknamed Node2Shell, Broccoli2Shell and HTTP2Shell, was added to CISA's Known Exploited Vulnerabilities catalog with a November 10 federal patch deadline.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
An out-of-bounds write in Google's Brotli decoder affects Node.js, .NET, PowerShell and Python packages, and researchers say it can lead to code execution.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
A buffer overflow in Google's Brotli C decoder can corrupt memory and expose data. Node.js, .NET and Python packages have shipped fixes, and proof-of-concept exploits are public.
VulnerabilitiesBrief2 min read
The project shipped fixes for 10 flaws across its three supported release lines on October 21, with the bundled Brotli decompression code rated the most serious.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
Researchers say crafted Brotli data made an official Node.js 24.22.0 Linux arm64 image run attacker-supplied code, exploiting a buffer overflow in the bundled decoder.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.21 min read
A buffer overflow in Google's Brotli decoder lets crafted compressed data corrupt memory, and the affected code ships inside many programs that unpack Brotli streams.
