Node2Shell puts Microsoft and Node.js on Brotli patch duty
Summary
A critical vulnerability, CVE-2026-111497, has been discovered in Google's Brotli compression library, specifically in its decoder implementations. This flaw can lead to remote code execution, information disclosure, or denial of service in applications processing compressed data. Microsoft and Node.js have released security updates, and other affected libraries like Python's Brotli have also been patched.
IFF Assessment
This vulnerability allows attackers to execute arbitrary code, posing a significant threat to systems and data.
Severity
The vulnerability has a high severity due to its potential for remote code execution (attack vector: network), which can lead to complete system compromise. The impact on confidentiality, integrity, and availability is high.
Defender Context
This vulnerability highlights the risks associated with software supply chain dependencies, as a flaw in a common library can affect multiple applications and platforms. Defenders should prioritize patching affected Node.js and .NET environments and be vigilant about processing untrusted compressed data, especially in web applications and containerized deployments.