#Brotli
All CosmicBytez Labs articles tagged #Brotli, across news, security advisories, how-to guides, and projects.
- News
Brotli CVE-2026-111497: PHP Rebuilds Windows Packages as Experts Temper HTTP2Shell Alarm
PHP shipped rebuilt Windows packages with Brotli 1.2.1 while experts note no in-the-wild exploitation of the critical Brotli decoder flaw so far.
- News
Microsoft Releases Emergency .NET Patches for Critical Brotli Flaw (Broccoli2Shell)
Out-of-band .NET 8, 9 and 10 updates fix CVE-2026-111497, a Brotli decoder out-of-bounds write that can crash apps or enable RCE. PoCs are public.
- News
Brotli Decoder Flaw (CVE-2026-111497) Behind Node.js RCE Also Hits Bun, Python, Envoy and Istio
A memory-corruption bug in Google's Brotli decoder lets crafted data corrupt memory in Node.js, Bun, Python, Envoy and more. Update and restart.
- News
Node2Shell: Imperva Demonstrates RCE on Official Node.js Build Using Crafted Brotli Data
CVE-2026-111497, a Brotli decoder out-of-bounds write bundled in Node.js 22, 24 and 26, enabled code execution in Imperva's Node2Shell demo. Patch now.
- News
Node.js Brotli Decoder Bug (CVE-2026-111497) Could Allow Remote Code Execution in All Supported Versions
Node.js 22.x, 24.x and 26.x security releases fix 10 flaws, including a Brotli out-of-bounds write that can lead to remote code execution.