The Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 27 added a critical CVSS 9.2 Brotli bug known as Node2Shell to its known exploited vulnerabilities (KEV) catalog.
The National Institute of Standards and Testing (NIST) described CVE-2026-111497 as a buffer overflow vulnerability in the Brotli decoder of Google’s popular Brotli lossless compression algorithm.
NIST said the flaw lets a remote unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Jacob Krell, senior director for secure AI solutions and Cybersecurity at Suzu Labs, said Brotli runs as a compression format Google built to shrink web traffic, and applications often unpack it automatically before the data reaches application-level security controls. Node2Shell is a bug in that unpacker.
Krell explained that a specially crafted compressed stream tricks the decoder into treating an invalid instruction as a request for more data, so it keeps writing past the memory buffer it's supposed to use.
“Think of a warehouse worker following a corrupted packing slip that keeps saying add more items to an already full box, until the spill crosses into someone else's storage space,” said Krell. “In software that means corrupting memory that belongs to something else, which can crash the application, leak sensitive data, or hand an attacker code execution on the server.”
John Gallagher, vice president at Viakoo Labs, said Google developed Brotli for the modern web to serve as a higher-efficiency successor to traditional gzip: it’s everywhere because it’s best-in-class at reducing bandwidth and improving core web functions. Gallagher noted that every major browser (Chrome, Safari, Edge, Firefox), content delivery network (Cloudflare, Fastly, Akamai), and web server engine adopted Brotli.
“Brotli is not merely a file-archiving tool, it sits directly inside the active I/O data pipeline of modern web servers, reverse proxies, IoT management dashboards, microservices, and API gateways,” said Gallagher. “A vulnerability inside a compression decoder represents one of the most hazardous threat vectors in systems architecture for three operational reasons: it executes pre-authentication, it bypasses edge defenses using in-band data manipulation, and it can trigger a range of exploitations up to remote code execution.”
Alessandro Lo Prete, threat detection engineer at Sysdig, explained that Brotli was built via the open source Node.js environment through its zlib module; essentially, it shrinks a lot of what moves between browsers and servers, so that pages load faster.
Lo Prete pointed out that the flaw resides in the decoder, not in the algorithm itself: if someone sends a specially crafted data stream, the unpacking code does not reject it, the stream keeps writing past the end of the memory it was given. In the worst case, Lo Prete said this can let an attacker crash a server or run their own code on it.
“That matters because unpacking is one of the first things a server does with incoming data, often before it checks who sent it,” said Lo Prete. “An attacker does not need credentials. They only need to send crafted data. The same risk also applies when an app downloads data from a server it does not control. The fix is to update the Node.js environment and any other software that includes the Brotli library."
Bri Frost, director of product management at Cloud Range, added that flaws buried in shared components like Brotli don’t sit in one place a team can point to: they live inside runtimes, web servers, frameworks and container images, often in places no one has looked at in years. Frost said teams have to quickly assess every application and endpoint in their network to determine whether they’re vulnerable, because that first step has to happen before anything else.
“From there, applying the update is only part of the job,” said Frost. “If a process isn’t restarted or an old container image keeps getting redeployed, a system can look patched and still be exposed. Exposure isn’t closed when the patch is released. It’s closed when the team can prove nothing vulnerable is still running.”
