"Node2Shell" is a Brotli library bug: CVE-2026-111497 reaches beyond Node.js

Google Brotli: CVE-2026-111497

• What: CVE-2026-111497, first reported as a Node.js bug ("Node2Shell"), is in Google's Brotli compression library, versions 1.0.3 to 1.2.0. Updating Node.js alone does not cover it: any code, in any language, that decompresses untrusted Brotli data with a vulnerable copy of the library is exposed.
• Severity: Critical (9.2), as rated by Google, the assigning CNA. It can be triggered remotely without authentication and could allow code execution.
• Exploited: Not on CISA's Known Exploited Vulnerabilities list at the time of writing.
• Fixed in:
  • Brotli 1.0.10, 1.1.1 and 1.2.1.
  • Python brotli and brotlicffi 1.2.1 (GitHub advisory).
  • Node.js 22.23.4, 24.22.1 and 26.12.1.

What to check

• Python services: urllib3 uses brotli or brotlicffi automatically to decompress HTTP responses when either is installed, so check dependency trees, including serverless functions that bundle their own packages.
• Linux distributions: The Debian security tracker lists fixes only for Debian 12 and 13; Debian 11 has no fixed package. Web servers usually compress with Brotli rather than decompress it, which lowers the risk, but systems on Debian 11 should plan an OS upgrade.