# Advisory digest — CVE-2026-111497 in the outside world What the public record says about this CVE, kept separate from what was measured on our own hosts. Every claim carries its evidence level, because the levels are not interchangeable. > [!WARNING] > Evidence levels on this page: **measured** — verified by a command whose output is quoted; > **snippet** — read from a search-result snippet, full page not opened; **brief** — stated in the > vendor-sourced incident report the owner supplied on 27 October 2026, which cites NVD, Akamai, > Istio, Phoenix Security, OX Security and WindowsForum. Confirm a vendor version list on that > vendor's advisory before you act on it. ## 1. The vulnerability | Property | Value | Evidence | |---|---|---| | Identifier | CVE-2026-111497 | brief, snippet | | GitHub advisory | GHSA-3wvj-j6qm-62mr | brief | | Common names | Node2Shell, HTTP2Shell, Broccoli2Shell | brief, snippet | | Component | Google Brotli reference C decoder, `c/dec/decode.c` / `libbrotlidec` | brief, snippet | | Weakness | out-of-bounds write, CWE-787 | brief, snippet | | Affected upstream | 1.0.3 through 1.2.0 | measured on three hosts; brief; snippet | | Fixed upstream | 1.0.10, 1.1.1, 1.2.1 — shipped 21 October 2026 | brief, snippet | | Attack vector | network, unauthenticated, through crafted Brotli data | brief | | Impact | denial of service, memory disclosure, potential remote code execution | brief, snippet | | CVSS 4.0 | 9.2 | brief, snippet | | CVSS 3.x | 8.5 on distribution and vendor trackers | snippet | | Discovery credit | OpenAI Security Research | brief | | Public proof of concept | reported; Imperva demonstrated RCE against an official Node.js 24.22.0 Linux arm64 image | brief | | Mass exploitation | none confirmed in the reviewed sources — absence of confirmation does not lower the patch priority | brief | The severity gap is not a contradiction: 9.2 is the CVSS 4.0 base score published with the fix, 8.5 is the CVSS 3.x score used by downstream trackers. Quote the scale whenever you quote the number. ## 2. Root cause, in one paragraph The decoder meets a block-type switch that the stream's own structure makes invalid. A correct implementation treats that as a permanent format error; the vulnerable streaming decoder reports that it needs more input instead, keeps appending attacker-controlled bytes to an internal eight-byte buffer, and writes past its boundary. This is an out-of-bounds write, not a parsing error: the outcome depends on allocator layout, runtime hardening, platform and process privileges, and ranges from a reliable crash through heap disclosure to code execution. Public analyses differ on how reproducible the code-execution case is; the difference reflects exploit conditions, not severity. ## 3. Timeline | Date (2026) | Event | Evidence | |---|---|---| | 21 October | upstream releases 1.0.10, 1.1.1, 1.2.1 | brief, snippet | | 21 October | Node.js ships an out-of-cycle security release (ten fixes), led by this CVE; fixed in 22.23.4, 24.22.1, 26.12.1 | brief, snippet | | 23 October | vendor security advisories appear (Radware, Istio, others) | snippet | | 25 October | Ubuntu publishes `libbrotli1 1.2.0-3ubuntu0.1`; the packaged changelog names the CVE and describes the decoder change | measured (extracted `.deb`, read `changelog.Debian.gz`) | | 26 October | mainstream coverage begins (The Register on the .NET out-of-band update) | snippet | | 27 October | the field run documented on the [field cases](04-Field-Cases) page | measured | ## 4. Three names, one defect The flaw circulates as **Node2Shell**, and also as **HTTP2Shell** and **Broccoli2Shell**. This is a detection problem, not trivia: a query for "brotli" misses the write-ups that use only the nickname, and a query for the nickname misses distribution advisories. Inventory and monitoring rules should carry the identifier and all three names. The GHSA identifier matters for the same reason — GitHub dependency alerts report it, not the CVE. ## 5. What the record does not settle | Open question | State of the record | What to do | |---|---|---| | Node.js 20.x, 23.x, 25.x | no official fix in the reviewed sources | migrate to a supported line; patching packages changes nothing for a bundled decoder | | Ubuntu 20.04 and older | no fixed package identified | migrate, or build a patched package through a supported channel | | Statically linked and vendored copies | package updates do not reach them | inventory binaries and rebuild from patched sources | | Bun standalone executables | existing artifacts stay vulnerable after `bun upgrade` | rebuild every executable | | RCE reproducibility | sources disagree on observed impact | treat RCE as credible; patch exposed decode paths first | | Istio data plane | control-plane releases exist, the proxy version is what matters | audit `EnvoyFilter` use and confirm proxy versions | | Third-party bundles | vendors may embed their own Brotli | track vendor advisories; rescan final artifacts | ## 6. Where this repository stops The tool in this repository remediates the **Debian and Ubuntu package path** and verifies the running processes. It does not patch Node.js, Bun, Python wheels, .NET, Envoy or Istio, and it cannot see a statically linked copy. The rest of the record is split across pages so that each question has one home: | Question | Page | |---|---| | which component is affected and what fixes it | [Ecosystem matrix](06-Ecosystem-Matrix) | | how to find every copy on a host | [Inventory](07-Inventory) | | how to patch each runtime and in which order | [Remediation playbooks](08-Remediation-Playbooks) | | what to do while patching is not possible | [Interim mitigations](09-Interim-Mitigations) | | how this tool runs and verifies the package path | [Operating runbook](10-Operations) | ## 7. Sources | Source | Used for | Level | |---|---|---| | | identifier, affected and fixed ranges | cited by the brief | | | GHSA, impact wording, credit, Istio versions | cited by the brief | | | root cause, exposure paths, Node.js dates, PoC reference | cited by the brief | | | Bun, Python, Envoy lists; distro packages; mitigations | cited by the brief | | | indirect Python exposure | cited by the brief | | | .NET release lines, end-of-life Node lines | cited by the brief | | | component and affected range | snippet | | | version-based detection logic | snippet | | | aliases, patch urgency | snippet | | | edge-runtime question | snippet | | | Russian-language brief that started the work | brief | ## 8. Keeping this page honest 1. Re-read the packaged changelog before quoting a version: the distribution revision is the fix marker, not the upstream number. 2. Re-check a vendor matrix only for components that exist on the audited hosts. 3. Date every snippet-derived claim. An undated snippet is a rumour with a URL. Next: [Ecosystem matrix](06-Ecosystem-Matrix) — every component, its vulnerable range and its fix.