---
title: "Node2Shell Brotli Flaw Reaches .NET, Python, PHP, Envoy"
url: https://erroneo.us/security/briefs/brotli-cve-2026-111497-node2shell-beyond-nodejs/
description: "CVE-2026-111497 in Google Brotli 1.0.3-1.2.0 now has fixes in .NET, Python, PHP Windows builds, Envoy and Istio. No exploitation known. Patch this week."
type: security-brief
section: "Security Digest"
date_published: 2026-10-25
date_modified: 2026-10-26
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-111497"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Node2Shell Brotli Flaw Reaches .NET, Python, PHP, Envoy

**Verdict: Patch this week.** The bug sits in the shared Brotli decoder, so the fix has to reach every runtime and proxy that decodes untrusted Brotli data. Patch this week. Exploitation is unreported, and code execution has only been shown in a lab.

- **Who must act:** Teams running Node.js, .NET, Python with Brotli or brotlicffi installed, PHP for Windows with cURL decompression, or Envoy/Istio with a Brotli decompressor, where request bodies or fetched responses can come from untrusted parties.
- **Who can relax:** Services that never decode Brotli from untrusted sources, and anyone who only serves Brotli-compressed responses, do not reach the vulnerable decoder.
- **Affected:** Google Brotli 1.0.3 through 1.0.9, 1.1.0 and 1.2.0; Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1; .NET 8, 9 and 10 before 8.0.33, 9.0.22 and 10.0.14; .NET 11 previews before RC3; Python Brotli before 1.2.1; brotlicffi before 1.2.1.0; PHP 8.2-8.5 Windows builds shipping Brotli 1.2.0; Envoy 1.39.2, 1.38.5, 1.37.7 and 1.36.11 with a Brotli decompressor configured
- **Fixed:** Google Brotli 1.0.10, 1.1.1, 1.2.1; Node.js 22.23.4, 24.22.1, 26.12.1; .NET 8.0.33, 9.0.22, 10.0.14, 11.0 RC3; Python Brotli 1.2.1; brotlicffi 1.2.1.0; PHP Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1; Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12; Istio 1.31.2, 1.30.6, 1.29.9 (per The Hacker News); Bun 1.4.4 (per The Hacker News)
- **CVEs:** CVE-2026-111497
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Inventory every place that decodes Brotli: node -v, dotnet --list-runtimes, pip show Brotli brotlicffi, and the Envoy/Istio proxy versions in your meshes and gateways.
2. Upgrade to the fixed releases (Node.js 22.23.4/24.22.1/26.12.1, .NET 8.0.33/9.0.22/10.0.14, pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0", Envoy/Istio patch releases) and restart the processes.
3. Rebuild and redeploy container images, self-contained .NET apps and anything that bundles its own Brotli copy; a patched system libbrotli does not fix them.
4. On Windows PHP, install the -1 rebuilds from php.net; php -v will not change, so confirm by file name or SHA-256.
5. Where you cannot patch yet, reject Content-Encoding: br request bodies at the edge and turn off automatic Brotli decompression in HTTP clients, or uninstall the Python Brotli packages if nothing needs them.
6. Update OS brotli packages too (Debian and Amazon Linux have fixes), then track still-unfixed bundlers such as Apache Arrow and DuckDB.

### How to check if you are affected

- Search lockfiles and SBOMs for vulnerable copies: grep -i brotli poetry.lock uv.lock requirements*.txt, and scan images for brotli 1.0.3-1.2.0.
- List which packages pull in Python Brotli with pipdeptree -r -p Brotli; urllib3, requests, httpx and aiohttp decode br responses automatically when it is present.
- Look for unexplained crashes or decoder errors in Node.js, .NET or Envoy processes while handling br-encoded traffic. They are leads to investigate, not proof of an attack.

## What happened

The Brotli bug that Node.js fixed on October 21 is not a Node.js bug. It is in Google's Brotli C decoder (`c/dec/decode.c`), the library almost every runtime, proxy and data tool uses to decompress `br` data. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-111497) describes a buffer overflow in Brotli 1.0.3 through 1.2.0. A crafted Brotli stream can corrupt decoder memory, leak memory, crash the process or "potentially execute arbitrary code". Google, the CNA, scores it CVSS 4.0 9.2. [Red Hat](https://access.redhat.com/security/cve/CVE-2026-111497) rates it 8.1 (Important), on the grounds that attack complexity is high.

Google tagged fixed releases 1.0.10, 1.1.1 and [1.2.1](https://github.com/google/brotli/releases/tag/v1.2.1) on October 21. According to [The Hacker News](https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html), the code fix had been sitting in the Brotli source since February 27 without a release. Every project that bundles its own copy has had to ship its own update, and those updates arrived over the weekend:

- **Python:** `Brotli` 1.2.1 and `brotlicffi` 1.2.1.0 ([GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35), Oct 22).
- **Envoy:** 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12 for deployments with a Brotli decompressor configured ([GHSA-3wvj-j6qm-62mr](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr), Oct 23). Per The Hacker News, Istio 1.31.2, 1.30.6 and 1.29.9 and Bun 1.4.4 followed.
- **.NET:** out-of-band 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3 on Sunday, October 25 ([Microsoft](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). .NET Framework is not affected.
- **PHP for Windows:** rebuilt packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1 on October 26 ([php.net](https://www.php.net/archive/2026.php#2026-10-26-1)).

## Who is affected

Any process that decodes Brotli data an attacker can shape. There are two directions:

- **Inbound:** a request body sent with `Content-Encoding: br` that your framework inflates. Examples are Express 5 body parsers on Node.js, ASP.NET Core request decompression and an Envoy Brotli decompressor filter.
- **Outbound:** a compressed response that your HTTP client decodes automatically. This covers Node's `fetch()`, .NET `HttpClient` with `AutomaticDecompression`, PHP cURL with automatic decompression, and, per [Aikido](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497), urllib3, requests, httpx and aiohttp whenever the Brotli package is installed. Your code does not have to import Brotli for this to apply. Webhooks, link previewers, crawlers and anything else that fetches URLs supplied by users are the obvious targets.

Microsoft notes that ASP.NET Core request decompression and HttpClient automatic decompression are off by default. PHP says the same of cURL automatic decompression, though applications and HTTP libraries can turn it on.

## Do you really need to act?

Yes, but on a this-week schedule, not overnight. The CVE record's CISA assessment lists exploitation as "none" and automation as "no", and CISA has not added the flaw to KEV. [Imperva](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/) showed code execution on the official Node.js 24.22.0 Linux arm64 image, but the exploit is unpublished and needed several attempts. Red Hat says no reliable public proof-of-concept for code execution exists. Public crash inputs do exist, so denial of service is the realistic near-term risk.

The reason to move anyway is reach. This is memory corruption in a parser that sits directly on network input, built into runtimes most companies run somewhere. Patching it means updating many separate copies. The most common mistake will be updating the OS `libbrotli` and assuming the job is done. Node.js, .NET, the Python wheels, Envoy and PHP's Windows builds all carry their own copy.

## What to do now

1. Inventory: `node -v`, `dotnet --list-runtimes`, `pip show Brotli brotlicffi` (also inside images: `docker run --rm IMAGE pip show Brotli brotlicffi`), plus your Envoy and Istio proxy versions.
2. Upgrade: Node.js 22.23.4, 24.22.1 or 26.12.1. .NET 8.0.33, 9.0.22 or 10.0.14. `pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0"`, followed by refreshed lockfiles. The Envoy and Istio patch releases above. Then restart every affected process.
3. Rebuild container images and republish self-contained .NET apps. Microsoft points out that a newer host runtime does not patch a self-contained app.
4. On Windows PHP, install the `-1` builds. `php -v` shows the same version, so check the file name or the SHA-256 on the downloads page.
5. If you cannot patch yet, reject `br` request bodies at the edge and turn off automatic Brotli decoding in HTTP clients. Edge filtering does nothing for responses your servers fetch.
6. Apply OS updates as well (Debian and Amazon Linux have shipped them). Keep watching bundlers that had no fix as of October 26, including Apache Arrow and DuckDB.

## How to tell if you were hit

No attacks are reported, so the main job is measuring exposure. Search lockfiles and SBOMs for Brotli 1.0.3 to 1.2.0. Run `pipdeptree -r -p Brotli` to see what depends on Brotli. As a weak signal, review crash logs for Node.js, .NET or Envoy processes that died while handling `br`-encoded traffic since mid-October. Imperva cautions that such crashes are leads, not reliable signs of exploitation.

## Timeline

- Feb 27, 2026 — The fix lands in the Brotli source tree with no release (per The Hacker News).
- Oct 21, 2026 — Node.js security releases; Google tags Brotli 1.0.10, 1.1.1 and 1.2.1.
- Oct 22, 2026 — CVE and GHSA published; Imperva shows "Node2Shell" code execution; fixed Python packages released.
- Oct 23, 2026 — Envoy advisory; CISA assessment records no exploitation.
- Oct 25, 2026 — Microsoft ships out-of-band .NET 8, 9, 10 and 11 RC3 fixes.
- Oct 26, 2026 — PHP publishes rebuilt Windows packages with Brotli 1.2.1.

## Sources

1. [CVE record — CVE-2026-111497: Out-of-Bounds Write in Google Brotli Decoder](https://www.cve.org/CVERecord?id=CVE-2026-111497)
2. [Google Brotli — v1.2.1 release (security fix for CVE-2026-111497)](https://github.com/google/brotli/releases/tag/v1.2.1)
3. [GitHub Advisory — GHSA-9v8h-qqgm-4m35: Brotli decoder out-of-bounds write (brotli, brotlicffi)](https://github.com/advisories/GHSA-9v8h-qqgm-4m35)
4. [Microsoft .NET Blog — .NET October 2026 out-of-band security updates](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)
5. [Envoy — GHSA-3wvj-j6qm-62mr: Out-of-bounds write in Brotli decompressor](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr)
6. [PHP — Updated PHP Windows builds for Brotli security fix (Oct 26, 2026)](https://www.php.net/archive/2026.php#2026-10-26-1)
7. [Node.js — October 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
8. [Red Hat — CVE-2026-111497](https://access.redhat.com/security/cve/CVE-2026-111497)
9. [Imperva — Node2Shell: from Brotli data to remote code execution](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
10. [Aikido — Python packages vulnerable to Node2Shell (CVE-2026-111497)](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)
11. [The Hacker News — Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other widely used software](https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html)
12. [SecurityWeek — Node2Shell: Brotli flaw triggers patching across Microsoft, Node.js, Python packages](https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/)
13. [BleepingComputer — Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches](https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/)

---
Source page: https://erroneo.us/security/briefs/brotli-cve-2026-111497-node2shell-beyond-nodejs/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt