poslední zpráva · zachyceno
SPOJENO AI KEV ✓ (1 z 10) EPSS 0.83 (nejvyšší)
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]
Broadcom VMware Google Node.js Microsoft Brotli PHP Palo Alto Networks Fortinet Bun brotlicffi FI CA SE US GB FR IT CZ BE NL
CVE v události 10
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-105481 | 6.5 3.0 · hackerone | – | 0.00 |
| CVE-2026-105482 | 7.4 3.0 · hackerone | – | 0.00 |
| CVE-2026-105483 | 7.4 3.0 · hackerone | – | 0.00 |
| CVE-2026-106069 | 7.4 3.0 · hackerone | – | 0.00 |
| CVE-2026-106070 | 3.7 3.0 · hackerone | – | 0.00 |
| CVE-2026-106071 | 3.6 3.0 · hackerone | – | 0.00 |
| CVE-2026-106072 | 6.7 3.0 · hackerone | – | 0.01 |
| CVE-2026-106073 | 3.3 3.0 · hackerone | – | 0.00 |
| CVE-2026-106074 | 4.8 3.0 · hackerone | – | 0.00 |
| CVE-2026-111497 | 9.2 4.0 · Google | KEV ✓ | 0.83 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.8.
Jak se o tom psalo 24
-
· zachyceno · NCSC-FI FI
VMSA-2026-0008: Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)
Classification: Critical, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv3.0: 9.8, CVEs: CVE-2026-111497, Summary: 1. Impacted Products VMware Cloud Foundation 2. Introduction Node.js Brotli decoder out-of-bounds write remote code execution vulnerability. Workarounds are available to remediate this vulnerability in affected Broadcom products. 3. SDDC Manager remote code execution vulnerability (CVE-2026-111497) Description: Node.js as used in SDDC manager contains a remote code…
-
· Cyber Centre Kanada CA
AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…
-
· CERT-SE SE
Kritisk sårbarhet i Google Brotli
En kritisk sårbarhet i Google Brotli har publicerats. Sårbarheten CVE-2026-111497 har fått en CVSS-klassning på 9.2, och möjliggör för en oautentiserad angripare på distans att orsaka överbelastning av system eller potentiellt exekvera godtycklig kod. [1]
-
· BleepingComputer US
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
-
· zachyceno · NCSC-FI FI
26 Oct 2026 Updated PHP Windows builds for Brotli security fix
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.2, CVEs: CVE-2026-111497, Summary: The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression. In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled.…
-
· zachyceno · Sophos Threat Research GB
Node2Shell (CVE-2026-111497) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Node2Shell, Brotli
-
· zachyceno · NCSC-FI FI
CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
Classification: Critical, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-111497, Summary: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to…
-
· zachyceno · NCSC-FI FI
Fortinet: Multiple Node.js CVEs being investigated
Classification: Critical, Solution: Unavailable, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073, Summary: Fortinet is currently investigating the impact of these CVEs over Fortinet Products. Products under investigation: FortiOS Products confirmed NOT impacted: FortiManager FortiAnalyzer FortiClient EMS FortiAuthenticator…
-
· zachyceno · NCSC-FI FI
Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.1, CVEs: CVE-2026-111497, Summary: Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. To address…
-
· Tenable Research US
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js,.NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. Key Takeaways CVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Google's Brotli decoder library that Google, the CVE Numbering Authority (CNA),…
-
· zachyceno · CISA KEV US
Google Brotli Unchecked Return Value Vulnerability (CVE-2026-111497)
CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog. Affected product: Google Brotli. Remediation due date: 2026-11-10.
-
· zachyceno · CERT-FR – avis FR
Vulnérabilité dans les produits Palo Alto Networks (27 octobre 2026)
Une vulnérabilité a été découverte dans les produits Palo Alto Networks. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
-
· BleepingComputer US nadpis události
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]
-
· BleepingComputer US
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]
-
· Cyber Centre Kanada CA
Google security advisory (AV26-1085)
Serial number: AV26-1085 Date: October 26, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1.0.3 to versions prior to v1.0.10 Versions 1.1.0 to versions prior to v1.1.1 Versions 1.2.0 to versions prior to v1.2.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Brotli Releases
-
· CSIRT Itálie (ACN) IT
Google: disponibile PoC per lo sfruttamento della CVE-2026-111497
Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-111497, presente nel decoder di Google Brotli, libreria open source ampiamente impiegata per la compressione e decompressione dei contenuti web e incorporata in numerosi prodotti e framework software, tra cui Node.js, DuckDB, Apache Arrow, .NET e diverse librerie Python.
-
· CSIRT.CZ (CZ.NIC) CZ
Kritická zranitelnost Broccoli2Shell ohrožuje aplikace využívající HTTP
V kompresní knihovně Brotli byla objevena kritická zranitelnost Broccoli2Shell (CVE-2026-111497, CVSS 9,2), která může útočníkovi umožnit vzdálené spuštění škodlivého kódu (RCE) bez nutnosti autentizace. Ke zneužití může stačit, aby zranitelná aplikace zpracovala speciálně upravená komprimovaná data připravená útočníkem. Zranitelnost je závažná zejména kvůli širokému využití algoritmu Brotli, který patří mezi standardně podporované kompresní algoritmy protokolu HTTP vedle gzip a zstd. Používají…
-
· zachyceno · Fortinet PSIRT US
Multiple Node.js CVEs
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x,…
-
· zachyceno · CERT-FR – avis FR
Vulnérabilité dans les produits Microsoft (26 octobre 2026)
Une vulnérabilité a été découverte dans les produits Microsoft. Elle permet à un attaquant de provoquer une élévation de privilèges.
-
· Aikido Security BE
Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats
-
· Qualys US
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not in application packages, so dependency checks will not surface them. Qualys customers can find affected runtimes across hosts, containers,…
-
· NCSC-NL NL
NCSC-2026-0453 [1.00] [M/H] Kwetsbaarheid in Google Brotli-decoder
Google heeft een kwetsbaarheid verholpen in de Brotli-decompressiebibliotheek. Deze bibliotheek wordt onder meer gebruikt in Node.js. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door speciaal vervaardigde Brotli-gecomprimeerde gegevens te laten verwerken. Succesvol misbruik kan leiden tot een denial-of-service, toegang tot gevoelige gegevens uit het procesgeheugen of het uitvoeren van willekeurige code met de rechten van het getroffen proces.
-
· Aikido Security BE
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats