Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy

A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.

安全客October 26, 2026Translated from Chinese

Read at source

Google Brotli decoder has been found to contain a serious memory corruption vulnerability tracked as CVE-2026-111497. The flaw impacts Node.js, Python, Bun, Envoy and any other software that embeds the official Google Brotli implementation.

What is Brotli and why the impact is so broad

Brotli is a compression format developed by Google and now used for the majority of web traffic to reduce bandwidth and improve page-load times. Because it is part of the modern web standard, virtually every major web server, CDN and proxy relies on the same upstream decoder code. Node.js ships Brotli support natively, Python provides the brotli and brotlicffi packages, the Bun JavaScript runtime includes it by default, and the Envoy cloud-native proxy uses it when Brotli decompression is enabled.

The vulnerability is an Out-of-Bounds Write. An attacker who supplies a malicious Brotli-compressed payload can cause the decoder to write beyond allocated buffers, corrupting adjacent memory. Possible outcomes include denial of service, sensitive data leakage and, most critically, remote code execution.

Node2Shell: Imperva proves RCE on official Node.js builds

Researchers at Imperva successfully weaponized the flaw on unmodified Node.js 24.22.0 (Linux arm64). They named the technique Node2Shell. The exploit works by feeding specially crafted Brotli data to functions such as zlib.brotliDecompress. Although reliability is not 100 percent and multiple attempts may be required, the attack succeeds on a stock release without any debugging symbols or weakened mitigations.

The same payload is blocked on the patched Node.js 24.22.1 release, confirming that the fix is effective. Earlier public proofs-of-concept only worked on deliberately weakened test builds; this demonstration on production binaries significantly raises the risk profile.

Affected software and remediation guidance

Node.js 22.x below 22.23.4, 24.x below 24.22.1, 26.x below 26.12.1
Python brotli and brotlicffi packages (all versions)
Bun all releases that include the built-in Brotli decoder
Envoy any deployment with Brotli decompression filters enabled

Administrators should immediately upgrade Node.js to the fixed releases listed above and restart all processes. Python users must wait for updated brotli packages or implement temporary input-size validation. Bun and Envoy users should monitor official channels for patches and consider disabling Brotli decompression until fixes are available.

Supply-chain lessons

The incident once again illustrates how a single upstream library can expose an entire ecosystem. Similar patterns were observed with Log4Shell and the xz-utils backdoor. Organizations are advised to maintain software bill-of-materials (SBOM) records, enable automated dependency updates via tools such as Dependabot, and apply defense-in-depth controls around any decompression routines.

Node.js Imperva CVE-2026-111497 Envoy Bun

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.

Security NEXTOct 29, 2026Translated from Japanese