Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.Key TakeawaysCVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Google's Brotli decoder library that Google, the CVE Numbering Authority (CNA), scored 9.2 under CVSSv4.0.Any application that decompresses attacker-controlled data with a vulnerable Brotli decoder is potentially at risk, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse.Patches are available for Google Brotli and the major runtimes, though some projects had not shipped a fixed release as of October 26, and applications that bundle their own copy of Brotli each need their own fix.BackgroundTenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Brotli2Shell, a vulnerability in Google's Brotli C decoder library, which Node.js, .NET and other software…

≈