CVE-2026-111497, the out-of-bounds write in the Brotli decoder, went on CISA's Known Exploited Vulnerabilities catalogue on 27 October with a due date of 10 November. We wrote about the flaw a week ago and recorded, from CISA's own enrichment of the record, that no exploitation was known. That is the sentence the catalogue has now overtaken.

What the entry actually names

The catalogue, at version 2026.10.27, lists the vendor as Google and the product as Brotli. The name it gives the flaw is "Google Brotli Unchecked Return Value Vulnerability", which is CWE-252, and the entry carries CWE-787 alongside it. Known ransomware use is recorded as unknown. The due date binds federal civilian agencies under BOD 26-04 and nobody else.

Most entries name something you install and run. This one names a compression library that sits inside things you install and run, and the catalogue says so itself, in a note no other entry this month carries: "This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products."

The link the note offers is the upstream release. Its entire body is the word SECURITY and the line "CVE-2026-111497: out-of-bounds write permits remote code execution".

The evidence is asserted rather than published

CISA says additions are made on "evidence of active exploitation" and publishes nothing further, which is how the catalogue has always worked. The alert of 27 October names 2 CVEs, gives each a single line, and offers no indicator, no victim and no telemetry. The public record is therefore thinner than the listing implies, and it is worth laying out what is actually in it.

ELLIO reported on 26 October that its sensors recorded an exploitation attempt against Node.js 24.22.0 on x86-64, combining public proof-of-concept code with an original chain. Tenable, which published the fullest roundup, says plainly that it has not independently confirmed that activity. Imperva's red team demonstrated code execution against an official Node.js 24.22.0 build after multiple attempts and has not released its exploit. At least one public proof of concept claims execution under narrow laboratory conditions.

None of that is the same as a named victim, and the catalogue does not supply one.

One bug, three fix lines

The CVE record puts the flaw in c/dec/decode.c and the affected range at Brotli 1.0.3 through 1.2.0, on all platforms, reachable by a remote unauthenticated attacker with a crafted compressed stream. The outcomes it lists run from disclosing memory to arbitrary code execution.

Upstream shipped three fixed versions rather than one: 1.0.10, 1.1.1 and 1.2.1. A project that backports across 3 branches is telling you something about who is still consuming the old ones, and the 1.0 line being one of them is the part worth reading twice.

Linked or bundled is the whole question

A program that loads the operating system's Brotli library picks up the distribution's fix and needs only a restart. A program that compiles its own copy in waits for its vendor, which is why one fix has landed on at least 4 separate dates: Envoy and Istio in early October by Tenable's timeline, Node and the library itself on 21 October, .NET on the 25th, the PHP builds for Windows on the 26th.

Debian has already fixed the library itself, as 1.0.9-2+deb12u1 on bookworm and 1.1.0-2+deb13u1 on trixie, under DLA-4855-1 and DSA-6582-1. Its security tracker also notes that its nodejs and python-brotlicffi packages use the system library, so on those systems the Node version string is not the answer to the question.

Node's own builds are a different matter, because they bundle. Fixed in 22.23.4, 24.22.1 and 26.12.1, with nothing for the lines that are out of support. Microsoft shipped .NET 8.0.33 out of band on 25 October and told customers to apply it "even if they installed the October 13 security update". Tenable's roundup adds Bun, Envoy, Istio, the PHP builds for Windows and the Brotli and brotlicffi packages on PyPI to the list of things that carry their own copy.

The naming has wandered to match. What one group called Node2Shell, another called HTTP2Shell as the Python clients came in, and Tenable now calls Brotli2Shell because the bug was never in Node at all. The nickname moved from the product to the library at roughly the speed the industry worked out where it lived.

What to do

  • Treat 10 November as the date, and treat it as a signal rather than an obligation if you are not a federal agency.
  • Inventory by library, not by product. Ask what links against Brotli and what ships a copy, because those two answers have different remedies.
  • On Debian and derivatives, patch the brotli package and restart the services that loaded it.
  • Update Node to 22.23.4, 24.22.1 or 26.12.1, .NET to the out-of-band October release, and check Bun, Envoy, Istio and any PHP build for Windows separately.
  • In Python, the Brotli or brotlicffi package is what decodes for urllib3, requests, httpx and aiohttp, so the HTTP client version is not the thing to check.
  • Anywhere you fetch a URL somebody else supplied, remember the response chooses the encoding, not your request.

What is not established

  • Who is exploiting it, against what, and with what success. CISA publishes the listing and not the evidence behind it.
  • Whether the attempt ELLIO reported succeeded. Tenable says it has not confirmed the activity independently.
  • Whether any production compromise exists. No victim has been named.
  • How much software carries a bundled copy nobody has inventoried, which is the population this entry is really about.
  • Whether the catalogue listing will move the vendors that have not yet shipped.

ELLIO's and Imperva's reports were not retrieved for this piece; both are as Tenable's roundup describes them.