Skip to content
brandefense.io
Request A Demo
Trending Vulnerabilities

Why it is trending

CVE-2026-111497

Out-of-Bounds Write in Google Brotli Decoder

Emerging
  • CVSS 9.2
  • Public PoC
Buzz
99discussion, 0-100
Danger
39exploitability, 0-100
Mentions
75since 21 Oct 2026
EPSS
0.5%exploit probability
Mentions Per Day · UTCpeak 54
29 days agoToday
Where The Talk Is · by platform75 total
  • X48 mentions · 46 voices
  • GitHub21 mentions · 21 voices · 19 PoC
  • Reddit2 mentions · 2 voices · 1 PoC
  • Dark web4 mentions · count only

    Out of 75 mentions in total. We show how many, never what was said or where.

Newest Public Posts · plain text, newest first

X

  • Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes n…

    @AikidoSecurity1 h agolikes 14views 525replies 1Open

  • Python has had this vulnerability for about 8 years and 7 months. Just as Node's CVE-2026-111497. Thanks Google!

    @realfludd1 h agolikes 0views 10replies 0Open

  • If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet. Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went…

    @semgrep2 h agolikes 2views 193replies 0Open

  • Protect against Brotli CVE-2026-111497 with Azure Web Application Firewall (WAF) https://t.co/22iiy9D0if https://t.co/Pa5mlZqpma

    @rodtrent2 h agolikes 0views 61replies 0Open

  • El fallo (CVE-2026-111497) está en el decodificador Brotli que Node trae adentro. Un dato comprimido malformado lo hace escribir fuera de un buffer interno de 8 bytes. Resultado: memoria corrupta → crash, fuga de memoria del proceso o, en el peor caso, RCE.

    @peldumHack3 h agolikes 0views 2replies 1Open

  • Protect against Brotli CVE-2026-111497 with Azure Web Application Firewall (WAF) https://t.co/OtCgDojRqH #Microsoft #techcommunity

    @MSITTechNews3 h agolikes 0views 6replies 0Open

  • Node.js fixed a Brotli bug on 21 Oct that can lead to RCE (CVE-2026-111497). By 23 Oct all of Riven was patched. Platform on Node 26.12.1, builds moved from Node 20 to 24, and every running app checked inside the container. Most users didn't have to do anything. https://t.co/te7ERoSUuc

    @rivendeploy3 h agolikes 0views 9replies 1Open

  • #Node2shell CVE-2026-111497-POC https://t.co/4rhjxpCoC0

    @dacbarbos3 h agolikes 0views 9replies 0Open

  • O Node.js corrigiu o CVE-2026-111497 em 21/10/2026 (22.23.4, 24.22.1, 26.12.1). A configuração de uma Lambda escolhe a linha principal (major), não o patch. Medi em 23/10: funções novas nos runtimes gerenciados .zip ainda vieram sem a correção. Como checar o que as suas rodam: https://t.co/cDM6B5u7…

    @frangoaguiar3 h agolikes 0views 14replies 1Open

  • Gateway Release 86 is out, and it's an important security release. It moves gateways to Node.js 22.23.4, fixing a Brotli remote code execution bug (CVE-2026-111497) along with Node's TLS and DNS fixes. Operators, please upgrade today!! https://t.co/DKq5t8bMGN

    @ar_io_network5 h agolikes 5views 236replies 0Open

GitHub

  • fuzheado/n2s-buildpack-probe: Throwaway probe: does Toolforge Build Service honour engines.node (CVE-2026-111497)

    fuzheado/n2s-buildpack-probe2 h agostars 0PoCOpen

  • Ghost-Bx1/Node2Shell-CVE-2026-111497:

    Ghost-Bx1/Node2Shell-CVE-2026-1114972 h agostars 0PoCOpen

  • CompleteTech-LLC/node2shell-check: Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. Python 3.10+, no dependencies, no exploit payloads.

    CompleteTech-LLC/node2shell-check3 h agostars 0PoCOpen

  • AmanSin001/node-brotli-check: Check a Node.js runtime for the CVE-2026-111497 Brotli decoder fix and find where a project decodes outside Brotli data. No dependencies.

    AmanSin001/node-brotli-check8 h agostars 0PoCOpen

  • Arkango/CVE-2026-111497: CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder OOB heap write. Independent research: exploit code, Docker labs, Express RCE gap analysis.

    Arkango/CVE-2026-1114978 h agostars 0PoCOpen

  • w116tjb/CVE-2026-111497_nodejs_hash_lookup:

    w116tjb/CVE-2026-111497_nodejs_hash_lookup8 h agostars 0PoCOpen

  • GitHub cross-source: ZeroHackOrg/node2shell-poc: ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework

    ZeroHackOrg/node2shell-poc13 h agostars 5PoCOpen

  • TahuCryptsi/brotli-distro-check: Audit Linux hosts for CVE-2026-111497 vulnerable brotli (1.0.3-1.2.0, CVSS 4.0 9.2). dpkg/apk/rpm/Node aware. Verified across live containers.

    TahuCryptsi/brotli-distro-check14 h agostars 0PoCOpen

  • shivrajem/node2shell-detect: Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows

    shivrajem/node2shell-detect15 h agostars 1Open

  • Saturate/CVE-2026-111497: Tools, POC and more for CVE-2026-111497

    Saturate/CVE-2026-11149719 h agostars 0PoCOpen

Reddit

  • [Threat Hunt] Node.js runtime exposure inventory (version taken from the install path) — EDIT - I created a higher fidelity query that uses a lookup file of node version and their hashes. // CVE-2026-111497 — Node.js runtime exposure inventory (hash lookup first, install path fallback) #event_simpl…

    r/crowdstrike9 h agoPoCOpen

  • Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) — First PHP. Now NodeJS. submitted by /u/One_Paint8721 to r/cybersecurity [link] [comments]

    r/cybersecurity24 h agoOpen
Public PoC Repositories · third-party code10 links

Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.

Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.

Subscribe