9:00AM, 29 October 2026
TLP Rating:
CVE-2026-111497 affecting Brotli Decoder
Brotli is a widely used compression library developed by Google. A buffer overflow vulnerability, tracked as CVE-2026-111497 ("node2shell"), may allow memory disclosure or arbitrary code execution when attacker-controlled Brotli-compressed data is processed.
While initially disclosed for Node.js, the issue may also affect other platforms and services that utilise Brotli over HTTP, including .NET and Java. Organisations should assess potentially affected systems and apply vendor-provided patches or mitigations as they become available.
NCSC is aware of active exploitation of this vulnerability as well as public proof-of-concept exploits.
The NCSC encourages organisations in New Zealand that use the affected products to review the advisory and apply the remediation as soon as possible. We also urge affected organisations to investigate unauthorised access or compromise of the affected products.
What's happening
Systems affected
|
Platform / Package |
Status |
Fixed Version |
Notes |
| Debian 12 & 13 (libbrotli1) | Patch Available | 1.0.9-2+deb12u1 / 1.1.0-2+deb13u1 | Fixes have been backported. Debian unstable remains unpatched. Debian's Node.js package includes the fix. |
| Alpine Linux 3.23, 3.24 & Edge (brotli-libs) | Patch Available | 1.2.1-r0 | Security update available. |
| Alpine Linux 3.21 & 3.22 (brotli-libs) | Patch Available | 1.1.0-1.amzn2023.0.2 | Fix has been backported; version numbering appears older than upstream releases. |
| Ubuntu (libbrotli1 / nodejs) | Patch Available | Refer to Ubuntu CVE guidance | Fixes vary by Ubuntu release. Patched Ubuntu and Node.js container images are also available. |
| Fedora (libbrotli) | Partial | Rawhide (F46) and ELN only | Fedora 43, 44 and 45 remain unpatched. |
| Red Hat Enterprise Linux (RHEL) 8, 9 & 10 | Partial | Hardened Images Only | No fixes currently available in standard repositories. |
| RHEL Node.js 24 & 26 Modules |
No Patch Yet |
None Released | No vendor fix currently available. Patched Node.js container images are available as a temporary mitigation. |
| SUSE | No Patch Yet | None Released | No vendor patch currently available. |
| Java (brotli4j / Netty-based) | Patch Available | 1.24.0 | Includes Brotli 1.2.1. |
|
.NET (System.IO.Compression) |
Patch Available | 8.0.33, 9.0.22, 10.0.14, 11 RC3 | .NET Framework is not affected. Self-contained applications and containers require rebuilding. .NET 7 remains affected with no fix available. |
| Python (Brotli / brotlicffi) | Patch Available | Brotli 1.2.1 / brotlicffi 1.2.1.0 | Affected versions begin from 1.0.3. |
What this means
Review vendor security advisories for all identified products to assess exposure, patch availability, and recommended remediation actions.
What to look for
How to tell if you're affected
Organisations should assess their libraries, runtimes, and container images to identify any use of Brotli decoding.
What to do
Prevention
Apply vendor-issued security updates as soon as they become available.
- Rebuild affected applications and container images following remediation.
- Implement temporary mitigations, such as disabling Brotli decompression, where patches are unavailable.
- Use vendor-supported patched container images where available.
- Continue monitoring vendor security advisories for updates and additional guidance.
Mitigation
Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
More information
Identify potentially affected products within your environment and refer to the corresponding vendor guidance for remediation and mitigation requirements.
If you require more information or further support, submit a report on our website: