Actively exploited Brotli flaw puts Node.js, .NET, PHP on Windows and other sof…

What happened

On October 21, 2026, Google fixed a serious flaw in Brotli, the library that unpacks data compressed with the Brotli format. A large part of the web uses this format to shrink pages and other traffic, so the library ends up inside many programs: Node.js, Bun, .NET, Python packages, the Envoy and Istio proxies, the official PHP builds for Windows and Palo Alto Networks firewalls. The flaw is tracked as CVE-2026-111497 and affects library versions 1.0.3 through 1.2.0.

Researchers from the Codex Security team at OpenAI found it. In the security community it goes by the nicknames Node2Shell, Broccoli2Shell and HTTP2Shell. One odd detail: the code change that closes the hole landed in Brotli’s source back in February, but nobody realised it fixed a security problem, so no Brotli release shipped it until October 21.

On October 27, 2026, the US agency CISA added the flaw to its catalog of actively exploited vulnerabilities, and the European vulnerability database run by ENISA has listed it as exploited since the same day. Security firm ELLIO recorded real attack traffic carrying the public Node.js exploit and believes the attacker is focused on mass exploitation. The same IP address has also been used in attacks on the PHP2Shell flaws in PHP.

Why it is dangerous

This is an out-of-bounds write, also known as a buffer overflow. Picture a paper form with a box for ten letters where someone writes a hundred and the text spills over into the neighbouring boxes. When the Brotli decoder unpacks specially crafted data, it writes past the end of its reserved space and corrupts the program’s memory. The result can be a crash, leaked sensitive data from memory or, in the worst case, the attacker’s code running on your server.

The attacker does not need to log in, and the attack works over the network. All it takes is for your application to unpack Brotli data that an outsider controls. According to OpenAI, it works in both directions: a malicious client can attack a server that accepts compressed requests, and a malicious server can attack a client that downloads data from it.

Imperva researchers demonstrated code execution on Node.js 24.22.0 for Linux on ARM64, and it took them several attempts. According to Cisco, proof-of-concept exploit code is public, and ELLIO confirmed that it works on vulnerable builds. Sysdig says the impact shown so far is crashes at scale and code execution in a narrow configuration. For .NET, Microsoft does not list code execution among the possible outcomes.

The CVSS score rates severity on a scale from 0 to 10. NVD rates the flaw 9.8 under CVSS 3.1. Google, which assigned the CVE, gives it 9.2 under CVSS 4.0. Both scores are critical. Red Hat rates it 8.1 under CVSS 3.1, and Microsoft also gives it 8.1 for .NET.

The CISA KEV catalog lists flaws with evidence of real-world exploitation. US federal agencies must fix this one by November 10, 2026. EPSS estimates the probability of exploitation within the next 30 days. For this flaw it is about 88%, which puts it among the riskiest 1% of all vulnerabilities.

Who is affected

Any program that bundles Google Brotli 1.0.3 through 1.2.0 and unpacks Brotli data from an untrusted source is affected. Typically that means web apps and APIs, reverse proxies and scripts that download data from the internet. Many products ship their own copy of the library, so each vendor has to fix it separately. The main ones are:

Node.js 22.x, 24.x and 26.x before the fix, plus the unsupported 20.x line and older. Most at risk are apps that download outside data with fetch() and apps built on Express 5 or body-parser 2.
Bun 1.4.3 and earlier.
.NET 8.0, 9.0 and 10.0 before the fix and 11.0 previews before RC3, only if the app decodes outside Brotli data (it is off by default in ASP.NET Core and HttpClient).
Envoy and Istio, only if Brotli decompression is enabled.
The Python packages Brotli 1.2.0 and earlier and brotlicffi 1.2.0.x and earlier. Being installed is enough, as clients like requests or httpx then decode Brotli themselves.
The official PHP 8.2 through 8.5 builds for Windows from October 21, 2026, if the app lets cURL decompress responses (Guzzle does so by default).
Palo Alto Networks firewalls on PAN-OS 11.2.4 and later, only with Brotli inspection (off by default) and TLS decryption enabled.

Other programs also carry a copy of Brotli, such as the ClickHouse database, the PHP Brotli extension, the Ruby “brotli” gem and the cdxgen tool (standalone binaries and images 13.4.0, 12.8.8 and earlier). Cisco and Fortinet are still reviewing their products. The .NET Framework, PAN-OS 11.1 and 10.2 and Panorama are not affected.

How to check if you are affected

Start by listing where you run Node.js, Bun, .NET, Python or PHP, including containers and systems supplied by vendors. These commands only print versions and change nothing:

node -v
bun --version
dotnet --list-runtimes
python3 -m pip show Brotli brotlicffi
dpkg -l | grep -i brotli
rpm -qa | grep -i brotli

Compare the output with the fixed versions in the section below. For containers, run the command inside the running container, for example with docker exec.

For PHP on Windows, php -v will not help, because the fixed build keeps the same version number. You can recognise it by the -1 in the file name, such as php-8.5.12-1-nts-Win32-vs17-x64.zip, and by the SHA-256 hash listed on the PHP downloads page.

On Palo Alto Networks firewalls with PAN-OS 11.2.4 or later, run the command below in the CLI. If the output shows Enabled: yes, the firewall is exposed. In the web interface (PAN-OS 12.1.2 and later), check the Allow Brotli Encoding option under Device > Setup > Content-ID.

show system setting brotli

How to fix it

Fixed versions according to the vendors:

Google Brotli: 1.0.10, 1.1.1 or 1.2.1.
Node.js: 22.23.4, 24.22.1, 26.12.1. There is no workaround, updating is the only fix. If you are on the 20.x line, move to a supported one.
Bun: 1.4.4.
.NET: 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3.
Envoy: 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12. Istio: 1.31.2, 1.30.6, 1.29.9.
Python: Brotli 1.2.1, brotlicffi 1.2.1.0.
PHP for Windows: 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1.
cdxgen: 13.5.0, 12.8.9.
Debian 13: brotli 1.1.0-2+deb13u1, Debian 12: 1.0.9-2+deb12u1. Amazon Linux 2023 shipped fixes on October 24, 2026, and Ubuntu is still evaluating.
PAN-OS: 12.2.4-h1, 12.1.7-h11, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1 are out, 12.1.4-h13, 12.1.10-h3 and 11.2.4-h23 are announced.

Work in this order:

First, internet-facing services that accept compressed requests or download data from outside servers.
Restart each service after updating, because a running process keeps the old library until it restarts. Rebuild container images, and rebuild and republish self-contained and NativeAOT .NET apps.
Then system packages and the rest of your software.

Where you cannot update yet, reject requests with a Content-Encoding: br header before anything decodes them, turn off automatic Brotli decoding in HTTP clients and uninstall the Brotli and brotlicffi packages in Python. Removing br from the Accept-Encoding header is not enough on its own. In PHP, do not set CURLOPT_ENCODING, and in Guzzle set decode_content to false. On PAN-OS, disable Brotli inspection:

set system setting brotli-encoding disable

What if you may already be compromised

Because attackers are already exploiting the flaw, assume that unpatched internet-facing services may have been targeted. Look for:

repeated unexpected crashes of Node.js, Bun or .NET processes and decompression errors in the logs,
requests with a Content-Encoding: br header from unknown clients,
connections from the Netherlands-based IP address that ELLIO links to attacks on this flaw and on PHP2Shell (the exact address is in ELLIO’s report and in The Hacker News coverage),
new processes (such as a shell) running as the application user, unknown files, new accounts and unexpected outbound connections.

If you find something suspicious, disconnect the server from the network but leave it running so traces in memory survive. Change the passwords and keys the application could access, and bring in an incident response specialist. Updating alone will not clean a server that has already been compromised.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Actively exploited Brotli flaw puts Node.js, .NET, PHP on Windows and other software at risk