Brotli decoder flaw enables remote code execution
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
An out-of-bounds write in Google Brotli's decoder (CVE-2026-111497) could let unauthenticated attackers achieve RCE; PoC public, no known in-the-wild exploitation.
A memory corruption vulnerability, tracked as CVE-2026-111497 and also referenced as Node2Shell, HTTP2Shell, and Broccoli2Shell, has been identified in the widely used Brotli compression library maintained by Google. The flaw is an out-of-bounds write in the decoder (c/dec/decode.c) caused by an error-handling defect in block-switch processing: when an invalid block switch occurs, the decoder incorrectly treats it as incomplete input and continues operating in an invalid state, writing beyond the intended buffer. A remote, unauthenticated attacker can exploit this by supplying a crafted Brotli-compressed stream to any application that decompresses untrusted Brotli data, potentially causing memory corruption, information disclosure, denial of service, or remote code execution with the privileges of the affected process.
The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0 and propagates to a wide range of downstream consumers: Node.js (versions prior to 22.23.4, 24.22.1, and 26.12.1; note 20.x, 23.x, and 25.x are EOL and unpatched), Bun 1.4.3 and earlier, Envoy Proxy and Istio when Brotli decompression is configured, Python brotli/brotlicffi, Java brotli4j, and .NET applications using Brotli decompression APIs. Exposure vectors include compressed HTTP request bodies (e.g., Express 5 default JSON body parsing), fetch() responses with Content-Encoding: br, and compressed files generally — making internet-facing web servers and APIs a primary concern.
No in-the-wild exploitation has been reported, but public proof-of-concept code exists, raising the likelihood of near-term exploitation attempts. Defenders should prioritize patching affected Brotli libraries and dependent runtimes/proxies, and as an interim mitigation, restrict or reject Content-Encoding: br on untrusted inputs at proxies or load balancers where Brotli decompression is not required.
Mentioned in this report
Detection guidance
Node.js or Bun Runtime Spawning Shell With Download or Recon Commands
Detects node.exe or bun.exe spawning cmd/PowerShell with download-cradle or recon arguments, a likely post-exploitation pattern after a memory-corruption RCE (e.g. Brotli decoder flaw) in a web-facing JS runtime. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js or Bun Runtime Spawning Shell With Download or Recon Commands
description: Detects node.exe or bun.exe spawning cmd.exe or PowerShell with download-cradle,
encoded-command or recon arguments. Post-exploitation pattern after RCE in an internet-facing
JavaScript runtime, such as the Brotli decoder out-of-bounds write (CVE-2026-111497).
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \node.exe
- \bun.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cli:
CommandLine|contains:
- whoami
- net user
- net localgroup
- DownloadString
- DownloadFile
- Invoke-WebRequest
- Invoke-Expression
- FromBase64String
- certutil
- bitsadmin
- ' -enc '
- curl
condition: selection_parent and selection_child and selection_cli
falsepositives:
- Developer machines running npm or build scripts that call curl or PowerShell download
helpers
- Node-based deployment tooling that shells out to PowerShell for installs
level: medium
id: 013bcca5-cbbd-530f-902a-a659a7f5061d
status: experimental
author: Vorant
Web Runtime Process Spawning Shell With Reverse Shell or Downloader Pattern on Linux
Detects node or bun spawning a POSIX shell with reverse-shell or download-and-execute arguments, indicating possible exploitation of a decompression memory-corruption flaw in a web-facing service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Runtime Process Spawning Shell With Reverse Shell or Downloader Pattern
on Linux
description: Detects node or bun spawning sh/bash/dash with reverse-shell, named-pipe,
base64-decode or curl/wget downloader arguments. Post-exploitation behaviour following
RCE in an internet-facing Node.js or Bun service, for example via the Brotli decoder
flaw.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /node
- /bun
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cli:
CommandLine|contains:
- /dev/tcp/
- bash -i
- mkfifo
- base64 -d
- 'curl '
- 'wget '
condition: selection_parent and selection_child and selection_cli
falsepositives:
- Node-based container health checks or entrypoint scripts that call curl or wget
- Build or deployment scripts run by npm on servers
level: medium
id: e54524c5-f251-58aa-baf7-ea423a4f95aa
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,359 reports from 144 sources, 627 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs