This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli

Brotli is a compression algorithm used for making data smaller during storage or internet transmission. Vulnerability CVE-2026-111497 is an out-of-bounds write issue in the Google Brotli decoder that affects versions 1.0.3 to 1.2.0 across all platforms. This flaw can be exploited by a remote, unauthenticated attacker to send a crafted Brotli-compressed stream, which can corrupt memory, leak sensitive data, crash the process, or even potentially execute arbitrary code.

This vulnerability shares the same flaw behind Node2Shell, affecting the same Brotli decoder. It receives a score of 9.2 (Critical) on the CVSS v4.0 scale. The root cause of the issue was fixed in the Brotli source code in February, but it took until now for the fix to be recognized as a security issue and released. Projects that bundle Brotli versions 1.2.0 or earlier, or brotlicffi 1.2.0.x, need to upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild any affected container images.

Although OpenAI discovered this issue in February, it was not recognized as a security issue at the time, and no release contained the fix until now. To mitigate exposure, users should upgrade their dependencies, rebuild applications and container images, and redeploy services to ensure they use the patched components.