# Brotli decoder flaw enables remote code execution

Published: 2026-10-27 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/9b303f5d-6220-558d-a7c4-dfa4f06a4284/brotli-decoder-flaw-enables-remote-code-execution
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> An out-of-bounds write in Google Brotli's decoder (CVE-2026-111497) could let unauthenticated attackers achieve RCE; PoC public, no known in-the-wild exploitation.

Source: cisecurity.org — https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2026-111497 (templated); no exploitation in the wild is recorded.

A memory corruption vulnerability, tracked as CVE-2026-111497 and also referenced as Node2Shell, HTTP2Shell, and Broccoli2Shell, has been identified in the widely used Brotli compression library maintained by Google. The flaw is an out-of-bounds write in the decoder (c/dec/decode.c) caused by an error-handling defect in block-switch processing: when an invalid block switch occurs, the decoder incorrectly treats it as incomplete input and continues operating in an invalid state, writing beyond the intended buffer. A remote, unauthenticated attacker can exploit this by supplying a crafted Brotli-compressed stream to any application that decompresses untrusted Brotli data, potentially causing memory corruption, information disclosure, denial of service, or remote code execution with the privileges of the affected process.

The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0 and propagates to a wide range of downstream consumers: Node.js (versions prior to 22.23.4, 24.22.1, and 26.12.1; note 20.x, 23.x, and 25.x are EOL and unpatched), Bun 1.4.3 and earlier, Envoy Proxy and Istio when Brotli decompression is configured, Python brotli/brotlicffi, Java brotli4j, and .NET applications using Brotli decompression APIs. Exposure vectors include compressed HTTP request bodies (e.g., Express 5 default JSON body parsing), fetch() responses with Content-Encoding: br, and compressed files generally — making internet-facing web servers and APIs a primary concern.

No in-the-wild exploitation has been reported, but public proof-of-concept code exists, raising the likelihood of near-term exploitation attempts. Defenders should prioritize patching affected Brotli libraries and dependent runtimes/proxies, and as an interim mitigation, restrict or reject Content-Encoding: br on untrusted inputs at proxies or load balancers where Brotli decompression is not required.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (templated)

## Detection guidance (public sample)

### Node.js or Bun Runtime Spawning Shell With Download or Recon Commands

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects node.exe or bun.exe spawning cmd/PowerShell with download-cradle or recon arguments, a likely post-exploitation pattern after a memory-corruption RCE (e.g. Brotli decoder flaw) in a web-facing JS runtime. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js or Bun Runtime Spawning Shell With Download or Recon Commands
description: Detects node.exe or bun.exe spawning cmd.exe or PowerShell with download-cradle,
  encoded-command or recon arguments. Post-exploitation pattern after RCE in an internet-facing
  JavaScript runtime, such as the Brotli decoder out-of-bounds write (CVE-2026-111497).
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \node.exe
    - \bun.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cli:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - Invoke-Expression
    - FromBase64String
    - certutil
    - bitsadmin
    - ' -enc '
    - curl
  condition: selection_parent and selection_child and selection_cli
falsepositives:
- Developer machines running npm or build scripts that call curl or PowerShell download
  helpers
- Node-based deployment tooling that shells out to PowerShell for installs
level: medium
id: 013bcca5-cbbd-530f-902a-a659a7f5061d
status: experimental
author: Vorant
```

### Web Runtime Process Spawning Shell With Reverse Shell or Downloader Pattern on Linux

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects node or bun spawning a POSIX shell with reverse-shell or download-and-execute arguments, indicating possible exploitation of a decompression memory-corruption flaw in a web-facing service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Runtime Process Spawning Shell With Reverse Shell or Downloader Pattern
  on Linux
description: Detects node or bun spawning sh/bash/dash with reverse-shell, named-pipe,
  base64-decode or curl/wget downloader arguments. Post-exploitation behaviour following
  RCE in an internet-facing Node.js or Bun service, for example via the Brotli decoder
  flaw.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /bun
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cli:
    CommandLine|contains:
    - /dev/tcp/
    - bash -i
    - mkfifo
    - base64 -d
    - 'curl '
    - 'wget '
  condition: selection_parent and selection_child and selection_cli
falsepositives:
- Node-based container health checks or entrypoint scripts that call curl or wget
- Build or deployment scripts run by npm on servers
level: medium
id: e54524c5-f251-58aa-baf7-ea423a4f95aa
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-brotli-library-could-allow-for-remote-code-execution_2026-120

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9b303f5d-6220-558d-a7c4-dfa4f06a4284/brotli-decoder-flaw-enables-remote-code-execution.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup