Critical Brotli decoder out‑of‑bounds write (CVE-2026-111497) — affects Brotli 1.0.3 through 1.2.0
Event summary
CVE-2026-111497 is a critical out-of-bounds write in Google’s Brotli C decoder documented in an upstream GitHub advisory and aggregated by OpenCVE; the advisory states the bug affects Brotli versions 1.0.3–1.2.0 and can corrupt memory, disclose sensitive contents, cause denial-of-service, or potentially allow code execution when processing crafted Brotli-compressed streams. BleepingComputer reports the issue and notes Brotli is built into Node.js, so administrators should monitor vendor guidance and apply upstream or downstream fixes as directed.
CHRONOS Wire · October 27 · Alert 2
Publication details
- Published
- Updated
- Revision
- r1
- Source
- BleepingComputer
Cliff Notes
- Critical Brotli decoder OOB write (CVE-2026-111497) affecting Brotli 1.0.3–1.2.0. Track vendor fixes and remediate embedded Brotli copies.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
A critical vulnerability (CVE-2026-111497) was disclosed in the Brotli C decoder used by many projects; crafted Brotli data can corrupt decoder memory, possibly leaking data, crashing processes, or enabling code execution. The upstream advisory and CVE identify affected Brotli versions 1.0.3 through 1.2.0; Node.js and other projects that embed Brotli may be exposed. Administrators should follow vendor advisories and apply patches or rebuild embedded copies where instructed.
Why Urgent Level 3
The advisory describes memory corruption and possible code execution when processing attacker-controlled Brotli streams; Brotli is embedded in at least some widely used runtimes, so affected deployments should follow vendor guidance promptly.
What Changed
An upstream GitHub security advisory (GHSA-9v8h-qqgm-4m35) describing an out-of-bounds write in Brotli's decoder was published and has been aggregated into CVE-2026-111497; security press has reported the issue and noted Brotli is embedded in Node.js.
What Is Genuinely New
An upstream GitHub advisory (GHSA-9v8h-qqgm-4m35) documents a buffer overflow in Brotli's decoder and OpenCVE/CVE-2026-111497 aggregates the finding; security press has reported the vulnerability and noted Brotli is embedded in Node.js.
CHRONOS Bottom Line
CVE-2026-111497 is a critical out‑of‑bounds write in Google’s Brotli C decoder (affecting upstream versions 1.0.3 through 1.2.0); follow vendor guidance and patch or rebuild embedded Brotli copies as advised.
Uncertainties / Known Unknowns
No explicit proof‑of‑concept code or confirmed large‑scale exploitation is present in the provided excerpts; extent of downstream runtime/vendor patches and required mitigation steps across ecosystems is not fully shown in the cited evidence.
Detailed Analysis
The GHSA advisory describes a buffer overflow in Brotli's decoder (c/dec/decode.c) affecting upstream Brotli 1.0.3–1.2.0 that can corrupt decoder state, disclose memory, cause DoS, or possibly enable code execution when processing a crafted Brotli stream. BleepingComputer notes the decoder is embedded in Node.js, indicating downstream exposure for runtimes and applications that ship Brotli.
Sources / Evidence
- 01Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patchesBleepingComputer2026-10-26
- 02Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package · GHSA-9v8h-qqgm-4m35GitHub Advisory Database2026-10-22
- 03CVE-2026-111497 – Vulnerability details (aggregated)OpenCVE / CVE database aggregation2026-10-26
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.