What happened
On October 26, Tenable published an FAQ on CVE-2026-111497, calling the Google Brotli decoder vulnerability “Brotli2Shell.” The flaw is an out-of-bounds write in the C decoder library. Google, acting as the CVE Numbering Authority, assigned it a CVSS v4.0 score of 9.2. Tenable says an attacker can reach it by causing an application to decompress crafted Brotli data, including a compressed HTTP response handled by an automatically decompressing client or a compressed request body accepted by a server.
The stated outcomes range from process crash and memory disclosure to potential remote code execution. Tenable says public proof-of-concept code is available. It also reports that Imperva and ELLIO reproduced code execution against stock Node.js 24.22.0, and that ELLIO reported an exploitation attempt against that version on October 26. The report does not say that the attempt became a confirmed compromise, and notes that the CVE was not then listed in CISA’s Known Exploited Vulnerabilities catalog.
The affected surface is broader than a single JavaScript runtime because products embed or depend on the Brotli decoder. Tenable lists Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, PHP for Windows, FFmpeg, Apache Arrow, and ClickHouse among relevant software or research paths. It also describes separate findings: JFrog obtained instruction-pointer control in FFmpeg through Brotli-compressed JPEG XL metadata without demonstrating code execution, and produced an infinite-loop denial of service in Apache Arrow.
Fixed versions named by Tenable include upstream Brotli 1.0.10, 1.1.1, and 1.2.1; Node.js 22.23.4, 24.22.1, and 26.12.1; Bun 1.4.4; supported fixed Envoy and Istio releases; .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; Python Brotli 1.2.1; and brotlicffi 1.2.1.0. PHP for Windows fixes are 8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1. Node.js 20, 23, and 25 are end-of-support lines and do not receive fixed releases. Tenable further says ClickHouse had merged, but not released, a fix as of October 26.
What the archive adds
This is a new fact on a known story: it adds public PoCs, a reported exploitation attempt, and additional runtime patch status to the initial disclosure. Earlier Field Notes covered the upstream fixed Brotli releases, deployment guidance across Node.js, Bun, Envoy, and Istio, and a Node.js security advisory.
Trend signal
No supplied pattern is genuinely specific to this dependency vulnerability.
Why now
The upstream fix was committed on February 27, while Node.js publicly disclosed the issue on October 21 and fixed Brotli releases arrived that day. Tenable’s October 26 update matters because the disclosure has progressed from patch guidance to public reproduction work and a reported exploitation attempt. Microsoft released .NET updates on October 25, and PHP for Windows builds followed on October 26.
Connections to other events
The event extends the same supply-chain exposure described in the earlier Brotli notes: software can be vulnerable because it embeds the decoder rather than because its primary application language or framework is itself the defect. The earlier deployment guidance is therefore still relevant, but this update adds urgency to checking runtime versions and copied native libraries.
Why it matters
A straightforward package scan may miss the operational question: where does a running service decompress attacker-controlled content? Teams need to inspect ingress paths, HTTP client behavior, sidecars and proxies, base images, and native dependencies bundled into products. The same application can have different exposure on the server side and the client side, depending on whether it accepts compressed requests or automatically processes compressed responses.
Patching the direct runtime is necessary but may not be sufficient. End-of-support Node.js lines need migration rather than a vendor fix, and applications that carry their own Brotli copy require their own rebuild or vendor update. A reported exploitation attempt and public PoCs also change prioritization: exposure should be assessed before a routine maintenance window where reachable decompression is present.
What happens next
- More downstream projects will publish fixed releases or advisories for bundled Brotli copies. (3 months, 80%). Watch for: release notes that name CVE-2026-111497 or Brotli version updates.
- Operators will identify unsupported runtime deployments that cannot receive an in-place fix. (3 months, 70%). Watch for: migration guidance for Node.js 20, 23, and 25 workloads.
Limits and uncertainty
Tenable reports a first exploitation attempt, but the supplied material does not establish a confirmed breach, its scale, a named victim, or broad active exploitation. A proof of concept and a successful reproduction on Node.js do not establish identical exploitability across every listed product. The report also does not provide a complete inventory of every application that statically links Brotli, nor does it show that all deployments accepting Brotli traffic are reachable by an attacker. Version checks must be paired with an assessment of actual decompression paths.
Skill to build now
Build a small runtime exposure inventory this week. For each internet-facing service, record its runtime and image version, whether it uses a proxy or service mesh, whether it accepts compressed request bodies, and whether its outbound HTTP clients automatically decompress responses. Compare the resulting list with the fixed versions in the advisory, then flag statically linked or vendor-bundled Brotli separately. This turns a CVE lookup into a deployable remediation queue.
Reader takeaway
CVE-2026-111497 is no longer only an upstream-library disclosure. Public PoCs and a reported exploitation attempt make it an immediate audit target for systems that decompress untrusted Brotli data. Update supported runtimes, migrate unsupported ones, and verify embedded copies rather than assuming a single application dependency captures the risk.
Open question
Which widely deployed products still bundle an affected Brotli decoder without a released fix, and which of those expose attacker-controlled decompression in production?