GHSA-9v8h-qqgm-4m35
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- Risk score
- 65/100
- CVSS
- 9.2 v4.0
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A buffer overflow vulnerability in the Brotli decoder allows a remote attacker to corrupt memory, disclose sensitive information, cause a denial of service, or potentially execute arbitrary code. An attacker could exploit this vulnerability to execute arbitrary code.
- Affected
- {'products': ['Brotli'], 'packages': [{'name': 'brotli', 'ecosystem': 'pip', 'vulnerable': '>= 1.0.3, < 1.2.1', 'patched': '1.2.1'}, {'name': 'brotlicffi', 'ecosystem': 'pip', 'vulnerable': '>= 1.0.3, < 1.2.1.0', 'patched': '1.2.1.0'}], 'versions': ['1.0.3', '1.0.4', '1.0.5', '1.0.6', '1.0.7', '1.0.8', '1.0.9', '1.0.1…
- Fix
- Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
- Exploitation
- No known exploitation
Not confirmed. 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.1 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.2 critical
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| brotli | pip | >= 1.0.3, < 1.2.1 | 1.2.1 |
| brotlicffi | pip | >= 1.0.3, < 1.2.1.0 | 1.2.1.0 |
References
- https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
- https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
- https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0
- https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6
- https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12
- https://github.com/google/brotli/releases/tag/v1.0.10
- https://github.com/google/brotli/releases/tag/v1.1.1
- https://github.com/google/brotli/releases/tag/v1.2.1
Original description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Last activity 22 Oct 2026. Patch Forecast updates every hour.