Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
CVE-2026-111497, also known as Brotli2Shell, Node2Shell, HTTP2Shell and Broccoli2Shell, is an out-of-bounds write in Google's Brotli decoder library. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. Google, as the CVE Numbering Authority, scored it 9.2 under CVSSv4.0. The impact ranges from a process crash to potential remote code execution. CVE Description CVSSv4.0 CVE-2026-111497 Google Brotli decoder out-of-bounds write vulnerability 9.2 For more information about the vulnerability, including affected versions, patch guidance, and Tenable product coverage, visit our blog.
