🛡️ CVE-2026-111497

The items that name it 19

• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas cves2026-10-29
• The OpenSourceMalware Show #27
  talkas cves2026-10-29It is written here as CVE-2026-111497 (Brotli bug that reaches far beyond Node.js, behind Node2Shell; cited as a resource title).

  Brotli bug that reaches far beyond Node.js, behind Node2Shell; cited as a resource title

• Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
  writeupas cves2026-10-29
• TLP Is Not a Suggestion
  articleas cves2026-10-28It is written here as CVE-2026-111497 (Node2Shell, a critical Brotli flaw in Node.js enabling RCE, mentioned only in a related-article blurb).

  Node2Shell, a critical Brotli flaw in Node.js enabling RCE, mentioned only in a related-article blurb

• CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
  articleas classification.key entities2026-10-28
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisoryas cves2026-10-27
• Node.js Brotli Decoder Out-of-Bounds Write Threatens Remote Code Execution Across All Supported Versions
  advisoryas cves2026-10-27It is written here as CVE-2026-111497: high-severity out-of-bounds write in the Node.js Brotli decoder, allowing remote code execution via malformed Brotli-compressed data processed by node:zlib or fetch().
• eMudhra, Brotli, and the Long Tail of a Security Fix
  articleas classification.key entities2026-10-26
• Masoud (@dev3mike) on X
  threadas cves2026-10-26It is written here as CVE-2026-111497: Brotli bug, CVSS 9.2, lets crafted compressed data corrupt memory and possibly run code.
• Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
  articleas classification.key entities2026-10-26
• Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
  advisoryas classification.key entities2026-10-25
• lee1981 (@lee1981b) on X
  articleas cves2026-10-25
• Brotlipocalypse
  writeupas classification.key entities2026-10-24
• Everything, everywhere, all at once… the week software broke | Endor Labs
  articleas cves2026-10-24It is written here as CVE-2026-111497: bug in the Brotli decompression code of Node.js that can let an attacker run code if the app decompresses attacker-controlled data (Node2Shell).

  Node2Shell

• Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
  advisoryas classification.key entities2026-10-23
• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-23
• Python Packages Vulnerable to Node2Shell
  writeupas classification.key entities2026-10-23
• Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
  advisoryas classification.key entities2026-10-22
• Paul Dragoonis (@dr4goonis) on X
  threadas cves2026-10-22It is written here as CVE-2026-111497 (Node.js, High: Brotli decoder out-of-bounds write).

  Node.js, High: Brotli decoder out-of-bounds write