Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
About this summary. This is a short excerpt from the description that Wiz published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js
Source attribution: headline and facts are from Wiz (wiz.io). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Vulnerabilities in node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These…
HPE Patches Dozens of Critical Flaws in Networking Products
Eight max-severity security defects could lead to remote code execution and authentication bypass.
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js…
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere.
Multiple Node.js CVEs
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and…
Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)
CVE-2026-111497 demonstrates how a single memory-corruption bug in a widely reused native decoder can affect applications far beyond the runtime where it was first…