Source: https://agentdast.com/newsletter/node2shell-brotli-cve-2026-111497

# Node2Shell: update Brotli decoders across your website stack

[By Tornike (@realtornikeo)](https://x.com/realtornikeo)

 Published Nov 4, 2026  Last updated Nov 4, 2026 

Original sources: [Node.js: October security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases); [Google Brotli: security releases](https://github.com/google/brotli/releases); [Microsoft: .NET advisory](https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9); [NCSC: exploitation and mitigation](https://www.ncsc.govt.nz/alerts/cve-2026-111497-affecting-brotli-decoder/)

## Does this apply to me?

**Node.js 22, 24 and 26** Before 22.23.4, 24.22.1 and 26.12.1, respectively 

An application decompresses attacker-controlled Brotli data.

Action: 22.23.4, 24.22.1 or 26.12.1 for the respective branch

**Google Brotli** 1.0.3 through 1.0.9, 1.1.0 and 1.2.0 

An application uses the affected decoder on untrusted input. Distributor backports can change package status.

Action: 1.0.10, 1.1.1 or 1.2.1 for the respective branch

**.NET 8, 9 and 10** Before 8.0.33, 9.0.22 and 10.0.14, respectively 

Brotli decompression is enabled or used on attacker-controlled input. Microsoft also lists affected .NET 11 previews.

Action: 8.0.33, 9.0.22 or 10.0.14 for the respective branch

## How severe is it?

**High: potential code execution**

Memory corruption can cause a crash, disclose process memory or potentially allow code execution. New Zealand's NCSC reports active exploitation; its alert does not establish that a particular website was compromised.

Node.js rates the flaw High. My assessment is that exposed decoders need prompt attention because of the potential impact and reported exploitation.

First reported Oct 21, 2026

`CVE-2026-111497`

## What happened

Node.js disclosed the decoder flaw on October 21. A crafted Brotli stream can write outside an internal buffer and corrupt process memory. The affected decoder also appears in other runtimes and packages.

Exposure requires an application to decompress attacker-controlled Brotli data. That data can arrive in a request body or in a response fetched by the application. Check dependencies and bundled libraries as well as the runtime.

## What to do now

1.  Update Node.js and affected Brotli packages using the fix for each deployed branch or your distributor's backport. Move unsupported Node.js releases to a supported version.
2.  Update affected .NET runtimes and packages. Rebuild and redeploy self-contained and NativeAOT applications, then restart running apps.
3.  Review request decoding and outbound HTTP clients. Where a fix is unavailable, stop decoding untrusted Brotli data until patched. A rule blocking compressed requests does not cover malicious responses.

## What this means for your website

Website code can encounter Brotli through dependencies and outbound requests as well as incoming traffic. Check the decoder actually shipped in each container or application; updating the host library alone may leave bundled copies exposed.

## Sources and updates

-   [Node.js: October security releases ↗](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
-   [Google Brotli: security releases ↗](https://github.com/google/brotli/releases)
-   [Microsoft: .NET advisory ↗](https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9)
-   [NCSC: exploitation and mitigation ↗](https://www.ncsc.govt.nz/alerts/cve-2026-111497-affecting-brotli-decoder/)

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

### Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

[Set up your agent →](https://agentdast.com/agents)

## Keep reading

-   [eMudhra CA keys compromised: update trust stores and check certificate chains](https://agentdast.com/newsletter/emudhra-certificate-authority-key-compromise)
-   [Linux TCP flaw: update the kernel on website hosts](https://agentdast.com/newsletter/linux-ipv4-tcp-use-after-free-cve-2026-98432)