A critical security vulnerability tracked as CVE-2026-111497, also known as Brotli2Shell, has been discovered in Google’s Brotli decompression library.
The flaw is an out-of-bounds write vulnerability that can lead to memory corruption, information disclosure, denial of service, and potentially arbitrary code execution when processing malicious Brotli-compressed data.
The vulnerability affects multiple platforms and software products, including Node.js, .NET, PHP (Windows builds), and other applications using vulnerable Brotli versions.
Affected Brotli versions: 1.0.3 through 1.2.0.
Fixed versions:
-
Brotli 1.0.10
-
Brotli 1.1.1
-
Brotli 1.2.1
Administrators should update affected libraries and applications, rebuild vulnerable containers where necessary, and restart affected services.
Read our technical analysis and mitigation guide:
How to Fix the Critical Brotli Vulnerability (CVE-2026-111497)
CVE: CVE-2026-111497
Reference: Google Brotli Security Fixes