Critical Brotli vulnerability exposes applications to remote code execution (CVE-2026-111497)

A critical vulnerability in Google’s Brotli compression library could allow attackers to corrupt memory, crash applications, disclose sensitive information and potentially execute arbitrary code. Security researchers have also reported proof-of-concept exploits, while the flaw has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue.

Tracked as CVE-2026-111497, the vulnerability affects Brotli’s decoder, which processes compressed data used to reduce the size of web content and improve loading speeds. The flaw has been assigned a critical CVSS 4.0 score of 9.2 and is also known as Brotli2Shell, Node2Shell and Broccoli2Shell.

The vulnerability is an out-of-bounds write in the decoder’s block-type switching logic. By supplying specially crafted Brotli-compressed data, an attacker may cause the decoder to write outside its intended memory boundaries, potentially corrupting adjacent memory and compromising the application processing the data.

Multiple platforms and applications affected

The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0, potentially placing a wide range of software at risk. Brotli is incorporated into numerous applications, runtimes and networking components, meaning organisations may be exposed even when they do not directly install or manage the compression library themselves.

Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio and Python’s Brotli-related packages. Firefox and Thunderbird also use Brotli decoder implementations, while PHP on Windows can reach the vulnerable code through its cURL extension when automatic HTTP response decompression is enabled.

Attackers do not necessarily need an account or authenticated access to exploit the flaw. However, successful exploitation depends on a vulnerable application processing attacker-controlled compressed data, so exposure varies according to how individual products and services handle Brotli decompression.

Public exploits increase urgency

Security researchers have published proof-of-concept code demonstrating exploitation of the vulnerability. NHS England’s cyber security team has reported that a public proof of concept is available and assesses future exploitation as likely. CISA added the vulnerability to its KEV database on 27 October 2026, increasing the urgency for organisations to identify and patch affected systems.

The availability of exploit code does not mean every system using Brotli is automatically exploitable. Nevertheless, organisations should prioritise internet-facing services that process compressed data supplied by untrusted sources.

Security updates available

Administrators should check their installed Brotli versions and update affected components to the appropriate fixed release:

• Brotli 1.0.x: update to version 1.0.10.
• Brotli 1.1.x: update to version 1.1.1.
• Brotli 1.2.x: update to version 1.2.1.

The PHP project has also published updated Windows builds containing the fixed Brotli 1.2.1 library: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These are dependency rebuilds rather than new PHP runtime versions.

Organisations should review software dependencies, including libraries bundled within applications, rather than checking only standalone Brotli installations. Where immediate patching is not possible, the Canadian Centre for Cyber Security recommends preventing affected applications from processing Brotli-compressed content from untrusted sources until updates can be applied. Systems should also be monitored for unexpected crashes and abnormal process behaviour.

With Brotli embedded across web infrastructure, development platforms and client applications, CVE-2026-111497 highlights how a vulnerability in a widely reused component can have consequences far beyond the original library. Organisations should identify their exposure and deploy the relevant security fixes as soon as possible.