PatchTheCEVCVE-2026-111497: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through
CVE-2026-111497 is a critical-severity flaw (CVSS 9.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: dimasma0305/CVE-2026-111497-POC (29 stars)
- GitHub PoC: CaterMaoZi/CVE-2026-111497-POC (12 stars)
- GitHub PoC: hypnguyen1209/CVE-2026-111497 (5 stars)
Advisories and coverage
Research and news
- Qualys Blog: Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do 2026-10-23
- The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data 2026-10-23
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.