/Vulnerability Library

Node.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Execution

CVE-2026-111497
Early Release

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Severity

Critical

CVSS Score

9.8

Exploit Probability

83%

Affected Product

node.js

Published Date

October 25, 2026

Template Author

assetnote, dhiyaneshdk

CVE-2026-111497.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-111497
CWE ID:
cwe-190

References

https://github.com/assetnote/node2shell-scannerhttps://www.slcyber.io/exposurehttps://nvd.nist.gov/vuln/detail/CVE-2026-111497

Remediation Steps

Update to version 1.0.10, 1.1.1, 1.2.1 or latest available version.