Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
Critical, CVSS 9.2Exploited · CISA KEVamended

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497GHSA-9v8h-qqgm-4m35

What to do

Vendor fix available. Upgrade each affected package to the fixed version on its release line (powershell 7.6.9, 7.5.13, 7.4.22; node-min 26.12.1, 24.22.1, 22.23.4; node 26.12.1, 24.22.1, 22.23.4; node 26.12.1, 24.22.1, 22.23.4; dotnet 10.0.14, 9.0.22, 8.0.33; 4 more packages under Affected packages), redeploy, then verify what is actually installed.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

  • Bitnami powershell

    Affected
    >= 7.4.0, < 7.4.22>= 7.5.0, < 7.5.13>= 7.6.0, < 7.6.9
    Fixed in
    7.4.22, 7.5.13, 7.6.9

  • Bitnami node-min

    Affected
    < 22.23.4>= 23.0.0, < 24.22.1>= 26.0.0, < 26.12.1
    Fixed in
    22.23.4, 24.22.1, 26.12.1

  • runtime node

    Affected
    >= 22.0.0, < 22.23.4>= 24.0.0, < 24.22.1>= 26.0.0, < 26.12.1
    Fixed in
    22.23.4, 24.22.1, 26.12.1

  • Bitnami node

    Affected
    < 22.23.4>= 23.0.0, < 24.22.1>= 26.0.0, < 26.12.1
    Fixed in
    22.23.4, 24.22.1, 26.12.1

  • Bitnami dotnet

    Affected
    >= 8.0.0, < 8.0.33>= 9.0.0, < 9.0.22>= 10.0.0, < 10.0.14
    Fixed in
    8.0.33, 9.0.22, 10.0.14

  • PyPI brotlicffi

    Affected
    >= 1.0.3, < 1.2.1.0
    Fixed in
    1.2.1.0

  • PyPI brotli

    Affected
    >= 1.0.3, < 1.2.1
    Fixed in
    1.2.1

  • Bitnami brotli

    Affected
    >= 1.0.3, < 1.0.10>= 1.1.0, < 1.1.1>= 1.2.0, < 1.2.1
    Fixed in
    1.0.10, 1.1.1, 1.2.1

  • Bitnami dotnet-sdk

    Affected
    >= 8.0.0, < 8.0.33>= 9.0.0, < 9.0.22>= 10.0.0, < 10.0.14
    Fixed in
    8.0.33, 9.0.22, 10.0.14

Sources

Severity and exploitation
Exploitation
Confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.
CVSS 4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N · score source
EPSS
  • CVE-2026-111497: 82.64% estimated exploitation activity in the next 30 days; percentile 99.67 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 19 · amended ·

    Amended from osv record GHSA-9v8h-qqgm-4m35

  2. Revision 18 · amended ·

    Amended from ghsa record GHSA-9v8h-qqgm-4m35

  3. Revision 17 · amended ·

    Amended from osv record BIT-powershell-2026-111497

  4. Revision 16 · amended ·

    Amended from osv record BIT-node-min-2026-111497

  5. Revision 15 · amended ·

    Amended from osv record BIT-node-2026-111497

  6. Revision 14 · amended ·

    Amended from osv record BIT-dotnet-sdk-2026-111497

  7. Revision 13 · amended ·

    Amended from osv record BIT-dotnet-2026-111497

  8. Revision 12 · amended ·

    Amended from osv record BIT-brotli-2026-111497

  9. Revision 11 · amended ·

    Amended from osv record PYSEC-2026-4323

  10. Revision 10 · amended ·

    Amended from osv record PYSEC-2026-4322

  11. Revision 9 · amended ·

    Amended from osv record GHSA-9v8h-qqgm-4m35

  12. Revision 8 · amended ·

    Amended from ghsa record GHSA-9v8h-qqgm-4m35

  13. Revision 7 · amended ·

    Amended from vendor_advisory record nodejs-security-wg:core:204

  14. Revision 6 · evidence added ·

    CISA KEV confirmed exploitation for CVE-2026-111497 (date added 2026-10-27). Customer workflow unchanged.

  15. Revision 5 · amended ·

    Amended from ghsa record GHSA-9v8h-qqgm-4m35

  16. Revision 4 · amended ·

    Amended from ghsa record GHSA-9v8h-qqgm-4m35

  17. Revision 3 · amended ·

    Reviewed OSV alias/range/CVSS4 correction; package source scopes and original publication preserved. No customer finding resolved.

  18. Revision 2 · amended ·

    Amended from osv record GHSA-9v8h-qqgm-4m35

  19. Revision 1 · created ·

    Published from ghsa record GHSA-9v8h-qqgm-4m35

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-111497

Advisory: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
IDs: CVE-2026-111497, GHSA-9v8h-qqgm-4m35
Record: https://patchnext.com/advisories/ghsa-9v8h-qqgm-4m35 (revision 19, source checked 4 Nov 2026, 06:20 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.2)
Exploitation: confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.
Vendor response: Vendor fix available; fixed versions by package: powershell 7.6.9, 7.5.13, 7.4.22; node-min 26.12.1, 24.22.1, 22.23.4; node 26.12.1, 24.22.1, 22.23.4; node 26.12.1, 24.22.1, 22.23.4; dotnet 10.0.14, 9.0.22, 8.0.33; brotlicffi 1.2.1.0; brotli 1.2.1; brotli 1.2.1, 1.1.1, 1.0.10; dotnet-sdk 10.0.14, 9.0.22, 8.0.33. A vendor fix does not mean a deployment is fixed.

## Affected components
- Bitnami powershell: affected >= 7.4.0, < 7.4.22; >= 7.5.0, < 7.5.13; >= 7.6.0, < 7.6.9; fixed in 7.4.22, 7.5.13, 7.6.9
- Bitnami node-min: affected < 22.23.4; >= 23.0.0, < 24.22.1; >= 26.0.0, < 26.12.1; fixed in 22.23.4, 24.22.1, 26.12.1
- runtime node: affected >= 22.0.0, < 22.23.4; >= 24.0.0, < 24.22.1; >= 26.0.0, < 26.12.1; fixed in 22.23.4, 24.22.1, 26.12.1
- Bitnami node: affected < 22.23.4; >= 23.0.0, < 24.22.1; >= 26.0.0, < 26.12.1; fixed in 22.23.4, 24.22.1, 26.12.1
- Bitnami dotnet: affected >= 8.0.0, < 8.0.33; >= 9.0.0, < 9.0.22; >= 10.0.0, < 10.0.14; fixed in 8.0.33, 9.0.22, 10.0.14
- PyPI brotlicffi: affected >= 1.0.3, < 1.2.1.0; fixed in 1.2.1.0
- PyPI brotli: affected >= 1.0.3, < 1.2.1; fixed in 1.2.1
- Bitnami brotli: affected >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1; fixed in 1.0.10, 1.1.1, 1.2.1
- Bitnami dotnet-sdk: affected >= 8.0.0, < 8.0.33; >= 9.0.0, < 9.0.22; >= 10.0.0, < 10.0.14; fixed in 8.0.33, 9.0.22, 10.0.14

## Suggested inspection (read-only)
- Bitnami powershell: check the installed version with your package manager.
- Bitnami node-min: check the installed version with your package manager.
- runtime node: check the installed version with your package manager.
- Bitnami node: check the installed version with your package manager.
- Bitnami dotnet: check the installed version with your package manager.
- `python -m pip show brotlicffi`: prints the installed version. Run with the environment that serves production active.
- `python -m pip show brotli`: prints the installed version. Run with the environment that serves production active.
- Bitnami brotli: check the installed version with your package manager.
- Bitnami dotnet-sdk: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on powershell, node-min, node, dotnet, brotlicffi, brotli, dotnet-sdk.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-9v8h-qqgm-4m35 (GitHub-reviewed advisory GHSA-9v8h-qqgm-4m35 lists affected ranges: PyPI brotli >=1.0.3 =1.0.3 <1.2.1.0)
- Verified: https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35 (OSV record GHSA-9v8h-qqgm-4m35 lists affected ranges: PyPI brotli >=1.0.3 =1.0.3 <1.2.1.0 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-node-2026-111497 (BIT-node-2026-111497 names only Bitnami node; its three intervals come directly from that package's official OSV record. PyPI ranges remain those of GHSA/PYSEC.)
- Verified: https://osv.dev/vulnerability/BIT-node-min-2026-111497 (BIT-node-min-2026-111497 names only Bitnami node-min; its three intervals come directly from that package's official OSV record. PyPI ranges remain those of GHSA/PYSEC.)
- Verified: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases (Node.js confirms CVE-2026-111497 affects Node.js 22.x, 24.x and 26.x; its security-release links are 22.23.4, 24.22.1 and 26.12.1. Runtime ranges are independent of PyPI and Bitnami package scopes.)
- Verified: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on 2026-10-27.)
- Verified: https://nodejs.org/dist/index.json (The nodejs.org release index dates the first patched release for CVE-2026-111497 to 2026-10-20.)
- Verified: https://raw.githubusercontent.com/nodejs/security-wg/main/vuln/core/204.json (Node.js security working group core entry 204 lists CVE-2026-111497 affecting node >=22.0.0 =24.0.0 =26.0.0 <26.12.1)
- Verified: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on 2026-10-27.)
- Verified: https://osv.dev/vulnerability/PYSEC-2026-4322 (OSV record PYSEC-2026-4322 lists affected ranges: PyPI brotli >=0 <1.2.1 (fixed))
- Verified: https://osv.dev/vulnerability/PYSEC-2026-4323 (OSV record PYSEC-2026-4323 lists affected ranges: PyPI brotlicffi >=0 <1.2.1.0 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-brotli-2026-111497 (OSV record BIT-brotli-2026-111497 lists affected ranges: Bitnami brotli >=1.0.3 =1.1.0 =1.2.0 <1.2.1 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-dotnet-2026-111497 (OSV record BIT-dotnet-2026-111497 lists affected ranges: Bitnami dotnet >=8.0.0 =9.0.0 =10.0.0 <10.0.14 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-111497 (OSV record BIT-dotnet-sdk-2026-111497 lists affected ranges: Bitnami dotnet-sdk >=8.0.0 =9.0.0 =10.0.0 <10.0.14 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-node-2026-111497 (OSV record BIT-node-2026-111497 lists affected ranges: Bitnami node >=0 =23.0.0 =26.0.0 <26.12.1 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-node-min-2026-111497 (OSV record BIT-node-min-2026-111497 lists affected ranges: Bitnami node-min >=0 =23.0.0 =26.0.0 <26.12.1 (fixed))
- Verified: https://osv.dev/vulnerability/BIT-powershell-2026-111497 (OSV record BIT-powershell-2026-111497 lists affected ranges: Bitnami powershell >=7.4.0 =7.5.0 =7.6.0 <7.6.9 (fixed))

Commands are suggestions: review each one before running it.

Loading voting…