CVE-2026-111497CRITICAL
Node2Shell / HTTP2Shell / Broccoli2Shell: Brotli decoder out-of-bounds write (CVE-2026-111497)
Out-of-bounds write in Google's Brotli decoder lets crafted compressed data crash, leak memory or run code in Node.js and other Brotli users; in CISA KEV.
Updated 2026-11-09