Broccoli2Shell / Node2Shell / HTTP2Shell: Understanding CVE-2026-111497

Executive Summary

Broccoli2Shell, alternatively referred to as Node2Shell or HTTP2Shell, is associated with CVE-2026-111497. This critical out-of-bounds write vulnerability affects Google’s Brotli decompression library and carries a CVSS v4.0 severity score of 9.2.

Brotli is integrated into numerous applications and technology platforms, including Node.js, Python packages, Bun, .NET, Envoy, and Istio. Applications that rely on vulnerable versions to decompress content received from untrusted sources may be susceptible to exploitation.

The flaw enables specially constructed compressed input to overwrite memory belonging to a running process. The consequences depend on the affected application and its configuration. Potential outcomes include service crashes, exposure of sensitive information, and unauthenticated code execution. Attack surfaces may include compressed requests received by applications and compressed responses retrieved from external servers.

Organizations should review deployed applications and their dependencies for vulnerable components. Any applicable security updates should be installed, followed by a restart of the affected services.

Affected Products and Fixed Versions

Cynet Response and Investigation Guidance

Cynet Research continues to examine Broccoli2Shell (CVE-2026-111497) and evaluate its potential impact on customer environments. This work includes analyzing exploitation methods, reviewing publicly disclosed indicators of compromise, and monitoring reported malicious activity. The findings contribute to ongoing risk assessments and the development of appropriate protective measures.

Cynet’s CyOps MDR specialists are monitoring customer and partner environments for activity potentially linked to exploitation of this vulnerability. Particular attention is given to unexpected shell launches, abnormal child process creation, and suspicious outbound network connections from applications that may rely on vulnerable Brotli decoders. Identified activity is used to support additional investigation and incident response.

Cynet EPP provides visibility into processes running on monitored endpoints. This information allows CyOps analysts and customers to examine events preceding and following suspicious process execution. During investigations involving possible Broccoli2Shell exploitation, process telemetry can help establish connections between a vulnerable application and subsequently executed commands, utilities, or malicious payloads. Such analysis supports determining the extent of a potential compromise and selecting appropriate response actions.

Vulnerability Details

Brotli is a lossless data compression format commonly used for HTTP content transmitted with the br encoding. CVE-2026-111497 affects the format’s C-based decompression implementation. The DecodeBlockTypeAndLength() function processes block type transitions during decompression. The actual out-of-bounds memory write takes place later, within BrotliDecoderDecompressStream().

The vulnerability is triggered when a compressed stream specifies no more than one block type but subsequently attempts to switch blocks. Under these conditions, DecodeBlockTypeAndLength() returns BROTLI_FALSE. In vulnerable implementations, the same return value is also used to indicate that additional input is required. As a result, the streaming decoder incorrectly interprets an invalid block transition as a need for another input byte. Rather than rejecting the malformed stream, it continues processing and retries the operation. The security fix replaces the BROTLI_BOOL return type with BrotliDecoderErrorCode. It also introduces a separate error code for invalid block switches and updates the calling functions to propagate that error correctly.

During repeated processing attempts, BrotliDecoderDecompressStream() may add an attacker-controlled byte to a temporary buffer with a capacity of eight bytes. In release builds, effective boundary checking is absent. When the buffer index reaches eight, the next write extends beyond the allocated buffer and modifies the adjacent buffer_length field. This field determines how subsequent buffer indexes are calculated. Once corrupted, it may permit additional out-of-bounds writes. Under suitable exploitation conditions, these memory modifications could ultimately lead to arbitrary code execution, depending on the process memory layout.

Recommendations

Cynet advises organizations to promptly identify deployments containing components affected by Broccoli2Shell (CVE-2026-111497) and apply the relevant security updates. The vulnerability is classified as critical because it may allow remote code execution without authentication. Any deployed product that remains vulnerable should be upgraded immediately to its corresponding fixed release or a newer supported version.

According to patchtheplanet, several temporary measures can reduce exposure when immediate patching is not possible. These mitigations should remain in place until the affected components are updated:

• Incoming requests: Block requests containing Content-Encoding: br before decompression occurs in any proxy, middleware component, or request body parser. The restriction must also cover direct connections to origin servers and alternative request routes.
• Fetched responses: Turn off automatic Brotli decompression in HTTP client implementations. Responses compressed with Brotli should be rejected before decoding begins. Where the client cannot enforce this restriction, the affected retrieval operation should be suspended or performed using a patched client. Simply removing br from the Accept-Encoding header is insufficient, since a server may still return Brotli-compressed content.
• Envoy Proxy and Istio: Deactivate Brotli decompressor filters for both inbound requests and outbound responses. Because disabling these filters may allow compressed content to pass through unchanged, any downstream components capable of Brotli decompression must also be protected.
• Files and other inputs: Suspend the decompression of Brotli content originating from untrusted sources until the underlying decoder has received the security fix.