A single vulnerability identifier, CVE-2026-111497, has begun to circulate through the security press, pointing at a flaw in the Brotli compression decoder that Node.js relies on. Those who write about it describe a write that lands outside its intended bounds, a kind of error that can, in the worst case, hand control of a machine to someone who should not have it. The name given to the flaw has already changed more than once, which is often how the field's understanding of a problem grows before it settles. For now the story is less a finished account than an early map, drawn from headlines t
Brotli Decoder Flaw CVE-2026-111497 Prompts Emergency Patches Across Node.js and PHP on Windows
Three nicknames for one CVE suggest researchers are still mapping the flaw
Mark
So what is actually being reported here?
Mimi
A critical out-of-bounds write in the Brotli decoder, tracked as CVE-2026-111497, reportedly allowing code execution. Microsoft and PHP on Windows have both pushed emergency patches.
Mark
Why does Brotli matter so much?
Mimi
It's a compression algorithm that came out of Google and sits inside software that handles web traffic. A bug in the decoder can reach many applications at once.
Luke
Careful, though. Everything we have is headlines from a roundup, not the underlying advisories.
Mark
The names keep changing. Node2Shell, HTTP2Shell, Broccoli2shell.
Mimi
Aikido says Node2Shell evolved into HTTP2Shell as researchers saw libraries and apps using HTTP were affected. Wiz uses its own label.
Luke
Which tells us the scope was being revised, but not what the final scope is. Nicknames are marketing as much as measurement.
Mark
And the PHP detail, a second Windows update in five days?
Mimi
It hints the first fix wasn't the end of it.
Luke
Hints, yes. The headline doesn't say why. And nothing here confirms exploitation in the wild, affected versions, or how many systems are exposed. Those are open.
El Pulso
- A critical out-of-bounds write in the Brotli decoder has been flagged as capable of enabling code execution, raising the stakes for anyone running Node.js.
- The flaw's nickname has shifted from Node2Shell to HTTP2Shell, suggesting the damage may reach any library or application that speaks HTTP.
- Microsoft has rushed out an emergency patch and PHP has issued its second Windows security update in five days, a sign that fixes are arriving in a scramble.
- The reports disagree on scope and naming, and no fixed version numbers, attack details, or confirmed exploitation have yet been published.
A single vulnerability identifier, CVE-2026-111497, has begun to circulate through the security press, pointing at a flaw in the Brotli compression decoder that Node.js relies on. Those who write about it describe a write that lands outside its intended bounds, a kind of error that can, in the worst case, hand control of a machine to someone who should not have it. The name given to the flaw has already changed more than once, which is often how the field's understanding of a problem grows before it settles. For now the story is less a finished account than an early map, drawn from headlines that have not yet agreed on the shape of the ground.
Five outlets are now writing about the same identifier, CVE-2026-111497, and what they describe is a critical flaw in the Brotli decoder used by Node.js. The bug is an out-of-bounds write, a memory error that headlines say can lead to code execution, which is why it carries the critical label. Brotli is a compression algorithm that originated at Google, and the flaw has reached well beyond a single codebase.
The name attached to it keeps moving. It was first called Node2Shell, then Rapid7 and Aikido Security described it as HTTP2Shell, a sign that libraries and applications using HTTP may be exposed too. Wiz has added a third label, Broccoli2shell. Three names for one number suggest researchers are still measuring how far the problem extends.
Microsoft has issued an emergency patch, and PHP has released its second Windows security update in five days to address a Brotli code execution flaw. The second release hints that the first fix was not the end of it, though the headlines do not say why.
What remains unknown is considerable. No version numbers, trigger mechanisms, affected-system counts, or confirmed exploitation have been reported. The sources also do not fully agree on scope. Readers should watch for detailed advisories from Node.js, Microsoft, and PHP, and for further downstream patches. Searching by the CVE number is the safest course while the nicknames continue to shift.
The story arrives as a stack of headlines from five different outlets, all pointing at the same identifier: CVE-2026-111497. The source is a Google News roundup rather than a single reported article, so what follows is what those headlines say, and little more.
The flaw is described as a critical out-of-bounds write in the Brotli decoder used by Node.js. Brotli is a compression algorithm that originated at Google, and Forbes frames the bug as a critical flaw in a Google algorithm, for which Microsoft has issued an emergency patch. Rapid7 titles its entry on the vulnerability with the same CVE number and describes the weakness as an out-of-bounds write in the Node.js implementation. Headlines also say the flaw can lead to code execution, which is the reason it is being labeled critical.
The names attached to it have shifted. Aikido Security reports that the flaw, first nicknamed Node2Shell, has evolved into HTTP2Shell. According to that headline, the change reflects a widening of the problem: libraries and applications that use HTTP are affected, not only Node.js itself. Wiz, meanwhile, has published a guide under the name Broccoli2shell, promising everything readers need to know about the Brotli decoder vulnerability. Three nicknames for one CVE suggest researchers are still working out how far the flaw reaches.
The PHP side of the story comes from The Hacker News. Its headline says PHP has issued its second Windows security update in five days to fix a Brotli code execution flaw. That detail matters because it suggests the first fix did not settle the matter, or that a related problem surfaced soon after. The headline does not say which, and the available text does not explain it.
What the material does not provide is substantial. There are no version numbers for the patched releases, no description of how an attacker would trigger the bug, no count of affected systems, and no statement on whether anyone has exploited it. The headlines also do not fully reconcile: one outlet places the flaw in Node.js, others point to HTTP-using software broadly, and the patches named involve Microsoft and PHP on Windows. These may be consistent pieces of a downstream cascade, but the headlines alone do not establish that.
What to watch next is straightforward. Look for fuller advisories from Node.js, Microsoft, and PHP that name fixed versions, for further patches from other vendors that bundle Brotli, and for any confirmation of exploitation in the wild. Until then, the CVE number is the safest thing to search by, since the nicknames are still moving.
Citas Notables
Node2Shell has evolved into HTTP2Shell, as libraries and apps using HTTP are affected.— Aikido Security headline
Quieres la nota completa?
Lee el original en Google News ↗
Technology