Brotli Flaw Prompts Emergency Patches, but Experts Urge Calm as No Attacks Are Seen

A critical vulnerability, tracked as CVE-2026-111497, has been found in Brotli, a decompression library developed by Google and built into many applications, components and cloud services that run on open-source software. The buffer overflow flaw was discovered by OpenAI Codex Security and disclosed by Node.js in an Oct. 21 security advisory. It can cause system crashes and remote code execution. It has been nicknamed "Node2Shell" or "Broccoli2Shell".

Researchers have not seen the defect exploited in real networks, but concern is growing. Multiple vendors and software packages, including Microsoft and Python, have rushed out emergency patches. Wiz researchers warned that 91% of cloud environments have resources vulnerable to the flaw, and 82% have publicly exposed Node.js instances. Jake Knott of watchTowr said the attack surface is extremely broad, but the real impact depends on how each piece of software uses the library.

Christiaan Beek of Rapid7 Intelligence noted that many businesses have no idea how deeply components like Brotli are embedded in their technology. A compression library may sound boring, he said, but a small component can create a very large business risk. The flaw follows a pair of critical PHP vulnerabilities, dubbed "PHP2Shell", which had also not been exploited in the wild as of Monday afternoon.