CVE-2026-111497

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-111497
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/andybalholm/brotli/releases/tag/v1.2.7 Release Notes
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/23/25 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/24/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/26/12 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/26/13 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/26/16 Mailing List Third Party Advisory
https://broccoli2shell.com Third Party Advisory
https://github.com/advisories/GHSA-9v8h-qqgm-4m35 Third Party Advisory
https://github.com/dotnet/announcements/issues/494 Issue Tracking Mitigation Third Party Advisory
https://github.com/google/brotli/releases/tag/v1.0.10 Release Notes
https://github.com/google/brotli/releases/tag/v1.1.1 Release Notes
https://github.com/google/brotli/releases/tag/v1.2.1 Release Notes
https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html Mailing List Third Party Advisory
https://patchtheplanet.org/brotli Third Party Advisory
https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-045512.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-443410.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-898633.html Third Party Advisory
https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*
cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*
cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*

Configuration 2 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Configuration 3 (hide)

cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*

Configuration 4 (hide)

OR cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*

Configuration 7 (hide)

cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

Configuration 9 (hide)

cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*

Configuration 10 (hide)

cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*

Configuration 11 (hide)

cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*

Configuration 12 (hide)

cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*

Configuration 13 (hide)

OR cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*

Configuration 14 (hide)

cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*

Configuration 15 (hide)

cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*

Configuration 16 (hide)

cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*

Configuration 18 (hide)

OR cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:*
History

30 Oct 2026, 20:30

Type Values Removed Values Added
First Time Siemens ruggedcom Ape1808
Siemens data Flow Monitoring
Siemens
Siemens edge Opc Ua Server Configurator
Siemens ruggedcom Ape1808 Firmware
Siemens flow Creator Configurator
Siemens industrial Edge Databus Configurator
Siemens industrial Edge Management Cloud
Siemens industrial Edge Hub
Siemens industrial Edge Cloud Connector Configurator
Siemens common Configurator
References () https://cert-portal.siemens.com/productcert/html/ssa-045512.html - () https://cert-portal.siemens.com/productcert/html/ssa-045512.html - Third Party Advisory
References () https://cert-portal.siemens.com/productcert/html/ssa-443410.html - () https://cert-portal.siemens.com/productcert/html/ssa-443410.html - Third Party Advisory
References () https://cert-portal.siemens.com/productcert/html/ssa-898633.html - () https://cert-portal.siemens.com/productcert/html/ssa-898633.html - Third Party Advisory
CPE cpe:2.3:a:siemens:industrial_edge_cloud_connector_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:edge_opc_ua_server_configurator:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:data_flow_monitoring:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_management_cloud:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:common_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:flow_creator_configurator:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_databus_configurator:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_hub:-:*:*:*:*:*:*:*

30 Oct 2026, 19:18

Type Values Removed Values Added
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-045512.html -

30 Oct 2026, 11:17

Type Values Removed Values Added
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-443410.html -
  • () https://cert-portal.siemens.com/productcert/html/ssa-898633.html -

28 Oct 2026, 17:47

Type Values Removed Values Added
References () https://github.com/andybalholm/brotli/releases/tag/v1.2.7 - () https://github.com/andybalholm/brotli/releases/tag/v1.2.7 - Release Notes
References () https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high - () https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/10/23/25 - () http://www.openwall.com/lists/oss-security/2026/10/23/25 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/10/24/6 - () http://www.openwall.com/lists/oss-security/2026/10/24/6 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/10/26/12 - () http://www.openwall.com/lists/oss-security/2026/10/26/12 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/10/26/13 - () http://www.openwall.com/lists/oss-security/2026/10/26/13 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/10/26/16 - () http://www.openwall.com/lists/oss-security/2026/10/26/16 - Mailing List, Third Party Advisory
References () https://broccoli2shell.com - () https://broccoli2shell.com - Third Party Advisory
References () https://github.com/advisories/GHSA-9v8h-qqgm-4m35 - () https://github.com/advisories/GHSA-9v8h-qqgm-4m35 - Third Party Advisory
References () https://github.com/dotnet/announcements/issues/494 - () https://github.com/dotnet/announcements/issues/494 - Issue Tracking, Mitigation, Third Party Advisory
References () https://github.com/google/brotli/releases/tag/v1.0.10 - () https://github.com/google/brotli/releases/tag/v1.0.10 - Release Notes
References () https://github.com/google/brotli/releases/tag/v1.1.1 - () https://github.com/google/brotli/releases/tag/v1.1.1 - Release Notes
References () https://github.com/google/brotli/releases/tag/v1.2.1 - () https://github.com/google/brotli/releases/tag/v1.2.1 - Release Notes
References () https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html - () https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html - Mailing List, Third Party Advisory
References () https://patchtheplanet.org/brotli - () https://patchtheplanet.org/brotli - Third Party Advisory
References () https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 - () https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 - Third Party Advisory
References () https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ - () https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ - Third Party Advisory
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 - US Government Resource
CPE cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*
cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*
cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*
cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*
cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*
cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*
cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Microsoft
Istio istio
Anthropic
Duckdb
Nodejs node.js
Envoyproxy envoy
Istio
7-zip p7zip
Google woff2
Envoyproxy
Clickhouse clickhouse
Tianocore
Python-hyper brotlicffi
Python-hyper
Andybalholm
Microsoft .net
7-zip
Mcmilk
Google brotli
Tianocore edk2
Debian debian Linux
Apache arrow
Andybalholm brotli
Nodejs
Apache
Clickhouse
Google
Mcmilk 7-zip-zstd
Anthropic bun
Duckdb duckdb
Debian

27 Oct 2026, 20:17

Type Values Removed Values Added
References
  • () https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ -
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 -

27 Oct 2026, 15:16

Type Values Removed Values Added
References
  • () https://github.com/andybalholm/brotli/releases/tag/v1.2.7 -

26 Oct 2026, 18:17

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/10/26/16 -

26 Oct 2026, 14:16

Type Values Removed Values Added
References
  • () https://patchtheplanet.org/brotli -

26 Oct 2026, 05:17

Type Values Removed Values Added
References
  • () https://broccoli2shell.com -
  • () https://github.com/dotnet/announcements/issues/494 -
  • () https://github.com/google/brotli/releases/tag/v1.0.10 -
  • () https://github.com/google/brotli/releases/tag/v1.1.1 -
  • () https://github.com/google/brotli/releases/tag/v1.2.1 -
  • () https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 -

26 Oct 2026, 04:17

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/10/26/12 -
  • () http://www.openwall.com/lists/oss-security/2026/10/26/13 -

24 Oct 2026, 18:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/10/24/6 -

23 Oct 2026, 23:17

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/10/23/25 -
  • () https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html -

23 Oct 2026, 22:16

Type Values Removed Values Added
References
  • () https://github.com/advisories/GHSA-9v8h-qqgm-4m35 -

23 Oct 2026, 14:17

Type Values Removed Values Added
References
  • {'url': 'https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

23 Oct 2026, 13:17

Type Values Removed Values Added
References
  • () https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/ -

22 Oct 2026, 14:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-22 14:17

Updated : 2026-10-30 20:30

NVD link : CVE-2026-111497

Mitre link : CVE-2026-111497

CVE.ORG link : CVE-2026-111497

JSON object : View

Products Affected

python-hyper

  • brotlicffi

7-zip

  • p7zip

siemens

  • common_configurator
  • industrial_edge_management_cloud
  • industrial_edge_hub
  • ruggedcom_ape1808_firmware
  • edge_opc_ua_server_configurator
  • ruggedcom_ape1808
  • industrial_edge_databus_configurator
  • data_flow_monitoring
  • industrial_edge_cloud_connector_configurator
  • flow_creator_configurator

duckdb

  • duckdb

envoyproxy

  • envoy

istio

  • istio

nodejs

  • node.js

mcmilk

  • 7-zip-zstd

clickhouse

  • clickhouse

debian

  • debian_linux

anthropic

  • bun

tianocore

  • edk2

google

  • brotli
  • woff2

andybalholm

  • brotli

microsoft

  • .net

apache

  • arrow
CWE
CWE-252

Unchecked Return Value

CWE-787

Out-of-bounds Write