Most server vulnerabilities live in one product. This one lives in a compression library that dozens of products quietly share, which is why it earned four nicknames in four days: Node2Shell, Python2Shell, HTTP2Shell, and Broccoli2Shell. The CVE is CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder (libbrotlidec), versions 1.0.3 through 1.2.0. A remote attacker with no login sends a malformed Brotli-compressed stream, and the decoder writes past the end of an internal buffer. The result can be a crash, leaked process memory, or arbitrary code execution.

Two facts make this urgent rather than merely critical. First, decompression usually runs before any authentication or authorization check: the payload is the request body, or a response your server fetches and decompresses automatically. HTTP clients and frameworks that auto-decompress Brotli responses are exposed even if your own code never touches Brotli directly, and Express 5 body parsers now handle Brotli too. Second, this is not theoretical. The flaw is exploited in the wild, it entered CISA's Known Exploited Vulnerabilities catalog on October 27, 2026, and the catalog's patch deadline is November 10, 2026. Scores: CVSS 3.1 9.8 Critical from NVD, CVSS 4.0 9.2 from Google; Ubuntu rates its own priority High. Wiz reported that 91% of cloud environments have resources vulnerable to this CVE, and 82% expose Node.js instances to the internet.

This is a patch playbook, not a news recap. Work through it in order: check, patch, verify.

Step 1: Find out if you are exposed

Check the host first, then the runtimes, then the containers. A clean result on one layer says nothing about the others, because each bundles its own copy of the decoder.

Ubuntu or Debian host. The system library is what Caddy, curl, Python, and anything else linked against it uses:

BASH
dpkg -l | grep brotli
apt-cache policy libbrotli1

You are patched on Ubuntu when the installed version is at or above the fixed build for your release: 24.04 (noble) needs 1.1.0-2ubuntu0.1, 22.04 (jammy) needs 1.0.9-2ubuntu0.1, 26.04 needs 1.2.0-3ubuntu0.1. The affected packages are brotli, libbrotli1, and python3-brotli, all covered by Ubuntu security notice USN-8956-1.

Node.js. Check the runtime, not your dependencies. npm audit will not find this: the vulnerable decoder is bundled inside Node itself, not in any npm package.

BASH
node --version

Fixed versions from the October 21, 2026 Node.js security release: 22.23.4 on the 22.x line, 24.22.1 on 24.x, 26.12.1 on 26.x. Anything earlier on those lines is vulnerable. Lines 20.x and earlier are end of life and will never receive this fix; if you are still on one, the only patch is moving to a supported line.

Containers. A patched host does not patch your images. List the Node version inside each running container:

BASH
docker exec <container> node --version

If a container reports a vulnerable Node, the fix is rebuilding its image from a patched base and restarting the service. Restarting matters: a running process keeps the old library loaded in memory, so a patched image that never restarts is still a vulnerable process.

Python. If your stack uses the Brotli or brotlicffi packages, they compile the same C decoder. Fixed versions are Brotli 1.2.1 and brotlicffi 1.2.1.0. Check with pip show Brotli brotlicffi and upgrade anything older.

Step 2: Patch it

Ubuntu/Debian:

BASH
sudo apt update && sudo apt install --only-upgrade libbrotli1 brotli python3-brotli

Then re-run the apt-cache policy check from Step 1 and confirm the installed version matches the fixed build for your release.

Node.js: upgrade the runtime to 22.23.4, 24.22.1, or 26.12.1 depending on your line, using whatever manages Node on that machine (package manager, version manager, or a fresh base image). Bun users need Bun 1.4.4, which bundles Brotli 1.2.1.

Containers: rebuild every image that contains a vulnerable Node or Brotli, push it, and restart the services that run it. Treat the rebuild as part of the patch, not an optional follow-up: the old image is the vulnerability, and it will come back on the next restart if you only patch the host.

Step 3: Prove the fix

Do not trust the upgrade command's exit code. Re-run every check from Step 1 and confirm:

  • libbrotli1 reports the fixed build for your Ubuntu release.
  • Every node --version reports 22.23.4, 24.22.1, or 26.12.1 (or newer).
  • Every container that reported a vulnerable version now reports a fixed one, after a restart.
  • Python Brotli/brotlicffi, if present, report 1.2.1 / 1.2.1.0 or newer.

If any check still shows a vulnerable version, that layer is still exposed, no matter what the others say. This is the step most patch windows skip, and it is the step that catches the forgotten container.

Step 4: If you cannot patch today

If a rebuild or an upgrade window is genuinely days away, block Brotli-compressed traffic at your proxy or WAF as a temporary stopgap. It reduces the attack surface while the real patch waits, but it is not a fix: legitimate Brotli traffic breaks too, and anything that decompresses Brotli behind the proxy stays exposed. Use it to buy days, not to close the ticket.

Why this one escaped the usual scanners

Three properties made CVE-2026-111497 easy to miss. First, it lives in a shared C library, not in application code, so the same flaw appears in Node.js, Bun, Envoy, Python packages, and system libraries at once. Second, the vulnerable copy is often bundled inside a runtime or an image, where dependency scanners do not look; your lockfile can be fully clean while your runtime is vulnerable. Third, the trigger is compressed data, which many stacks decompress automatically before any of your code runs. The lesson generalizes: when a CVE names a runtime or a shared library, check the runtime and the image, not just the dependency list.

The deadline is November 10. Check today, patch this week, and keep the verification output: for a flaw this widespread, "we upgraded" without a version number to show for it is not evidence.

Further reading on this site

Sources

  • Ubuntu security notice USN-8956-1: https://ubuntu.com/security/notices/USN-8956-1
  • Node.js, Wednesday, October 21, 2026 Security Releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
  • CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • NVD entry for CVE-2026-111497: https://nvd.nist.gov/vuln/detail/CVE-2026-111497