The discovery of a critical security vulnerability in the Brotli data compression library, developed by Google, has revealed widespread risks in software development environments. Researchers have dubbed it "Node2Shell" (registered as CVE-2026-111497). This vulnerability has triggered a technical alert involving security updates from Microsoft, the Node.js project, and Python package developers to mitigate the risks of Remote Code Execution (RCE).
The issue lies in an "out-of-bounds write" flaw in Brotli versions 1.0.3 through 1.2.0. Google has assigned this vulnerability a severity score of 9.2 on the CVSS v4 scale, placing it in the critical category. Exploiting this flaw leads to memory corruption, which can cause process crashes, memory leaks, or, worse, allow an unauthorized attacker to execute arbitrary code.
Why does this threat pose a technical risk?
The importance of Brotli lies in its status as a very popular library for compressing data transmitted over the web, and its decoder is integrated into a vast number of applications and software libraries. Any application that processes compressed data from an untrusted source—such as compressed HTTP requests, responses received from external servers, or compressed files—could be vulnerable to exploitation if it uses the affected version.
Affected scope and available fixes
The wave of updates has covered several critical technical sectors to ensure system integrity:
- Microsoft: Released updates for .NET environments (versions 8.0.33, 9.0.22, 10.0.14), Visual Studio (2019, 2022, 2026), as well as PowerShell (versions 7.4, 7.5, 7.6).
- Node.js and Python: Fixes have been released for the Node.js project and popular Python packages such as Brotli and brotlicffi.
- Other tools: Updates also included Bun, Envoy, and Istio.
What should developers and administrators do?
Experts emphasized that simply updating the libraries may not be sufficient in some cases, as processes already running will continue to use the affected code in memory. Therefore, the following steps are required:
- Update libraries immediately: Move to Brotli versions 1.0.10, 1.1.1, or 1.2.1 and above.
- Restart services: All affected services and applications must be restarted to ensure the new code is loaded and memory is cleared.
- Rebuild containers: In cloud computing environments, container images must be rebuilt based on base images that have been updated to include the fixes.