datadog-security-labs · Crawled Nov 1, 2026
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
1 CVEs
Read original article ↗
AI Summary
CVE-2026-111497 is a critical out-of-bounds write vulnerability in the Google Brotli C library, affecting multiple runtimes including Node.js, Python, Bun, .NET, Java brotli4j, Envoy, and Istio. The flaw allows memory corruption during Brotli decompression, enabling attackers to achieve denial of service, heap memory reads, and potentially remote code execution. Exploitation has been confirmed in the wild, with CISA listing it in its known exploited vulnerabilities catalog. The vulnerability stems from a boolean return value ambiguity in DecodeBlockTypeAndLength(), leading to unbounded memory writes and exploitable state corruption.
AI-extracted · verify before operational use
Extracted Entities 1 found
MITRE ATT&CK TTPs 7 techniques
T1055 Process Injection · Defense Evasion T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.004 File Deletion · Defense Evasion T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1498 Network Denial of Service · Impact T1499 Endpoint Denial of Service · Impact