Last checked
Assess exposurenode2shell
CVE-2026-111497
CVE-2026-111497 is a memory-corruption flaw in the shared Brotli decoder. Any service that decompresses attacker-controlled Brotli, in a request or an HTTP response, can be exposed.
Why this needs attention
The risk extends beyond Node.js deployments, and affected runtime and server-side fetch paths require active assessment. Active exploitation is not established in the reviewed sources, but scope and remediation guidance are still developing.
What to do now
Identify every Brotli decoder in running runtimes, dependencies, and container images, then use each vendor's security guidance to update or otherwise remove the vulnerable decoder.