Brotli Decoder Out-of-Bounds Write Triggers Multi-Platform Patching

# Brotli Decoder Out-of-Bounds Write Triggers Multi-Platform Patching

https://gcdradar.vercel.app/incidents/brotli-decoder-out-of-bounds-write-triggers-multi-platform-p · AIR-2026-1533 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Disclosed vulnerability with potential for code execution across multiple ecosystems.
- Fix status: Partly patched
- First reported: 2026-10-26
- AI role: No AI role
- Products: Brotli decoder, Node.js, .NET, PowerShell, Python
- CVE ids: CVE-2026-111497, CVE-2026-106072, CVE-2026-106069, CVE-2026-105483, CVE-2026-105482, CVE-2026-105481
- CVSS: 9.2

## Summary

An out-of-bounds write vulnerability in Google's Brotli decoder affects multiple runtimes including Node.js and Python packages. Vendors are issuing updates to address potential code execution risks.

## What to do

Update PHP Windows packages to the latest patched releases.

## Affected and fixed versions

- Fixed in: PHP 8.2
- Fixed in: PHP 8.3
- Fixed in: PHP 8.4
- Fixed in: PHP 8.5
- Fixed in: Node.js 22.x
- Fixed in: Node.js 24.x
- Fixed in: Node.js 26.x

## Latest updates

- 2026-10-27: Node.js releases updates for lines 22.x, 24.x, and 26.x addressing the Brotli decoder vulnerability (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+node.js+Affecting+Cisco+Products%3A+October+2026%26vs_k%3D1)
- 2026-10-27: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497)
- 2026-10-26: Microsoft releases emergency .NET security updates for the Brotli vulnerability (https://bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw)
- 2026-10-26: Palo Alto Networks reports impact on products from the Brotli decoder vulnerability CVE-2026-111497 (https://security.paloaltonetworks.com/CVE-2026-111497)
- 2026-10-26: PHP releases updated Windows packages for versions 8.2 through 8.5 addressing the Brotli vulnerability (https://thehackernews.com/2026/10/php-issues-second-windows-security.html)

## Sources

- 2026-10-26 SecurityWeek: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages https://securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages
- 2026-10-26 Fortinet: Multiple Node.js CVEs https://fortiguard.fortinet.com/psirt/FG-IR-26-187
- 2026-10-26 The Hacker News: PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw https://thehackernews.com/2026/10/php-issues-second-windows-security.html
- 2026-10-26 Palo Alto Networks: CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL) https://security.paloaltonetworks.com/CVE-2026-111497
- 2026-10-26 BleepingComputer: Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches https://bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches
- 2026-10-26 BleepingComputer: Microsoft releases emergency .NET patches for critical Brotli flaw https://bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw
- 2026-10-27 CyberScoop: Experts temper emergency-level alarms over critical Brotli defect https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell
- 2026-10-27 Help Net Security: Brotli bug reaches far beyond Node.js (CVE-2026-111497) https://helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497
- 2026-10-27 Cisco: Vulnerabilities in node.js Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+node.js+Affecting+Cisco+Products%3A+October+2026%26vs_k%3D1
- 2026-10-27 CISA: CVE-2026-111497: Google Brotli — Google Brotli Unchecked Return Value Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
- 2026-10-28 The Hacker News: Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html
- 2026-10-28 Cisco: Vulnerabilities in Node.js Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+Node.js+Affecting+Cisco+Products%3A+October+2026%26vs_k%3D1
- 2026-11-03 Help Net Security: Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up https://helpnetsecurity.com/2026/11/03/product-showcase-sweet-security-virtual-patching
- 2026-11-04 Cisco: Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+Node.js+and+Brotli+Affecting+Cisco+Products%3A+October+2026%26vs_k%3D1

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.