Brotli decoder out-of-bounds write enables remote code execution in popular runtimes
The claim
The authors assert that CVE-2026-111497 allows an unauthenticated remote attacker to achieve remote code execution by exploiting an out-of-bounds write in the Brotli decoder.
Published as: “Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability”
So what
The vulnerability puts the majority of cloud-hosted services at risk of remote code execution, making rapid patching of Brotli components a critical priority.
The five-minute version
The writeup describes CVE-2026-111497, an out-of-bounds write bug in the Brotli C decoder that can be triggered by malicious compressed data. Researchers demonstrated a proof-of-concept exploit against unpatched Node.js, showing that the flaw can lead to memory corruption, data disclosure, crashes, or remote code execution. Wiz telemetry indicates that 91% of cloud environments contain vulnerable instances, highlighting a broad attack surface. The authors provide patched version references and mitigation steps, but the exploitability of other listed products remains unverified.
What they found 4
- The Brotli decoder contains an out-of-bounds write that can be triggered by crafted compressed data.
“The flaw occurs when the decoder improperly handles specially crafted compressed data during block-processing operations, potentially writing beyond allocated memory boundaries.”
- Exploitation can lead to memory corruption, data disclosure, crashes, or remote code execution.
“Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE).”
- 91% of cloud environments have resources vulnerable to the flaw according to Wiz data.
“According to Wiz data 91% of cloud environments have resources vulnerable to CVE-2026-111497, and 82% of cloud environments have publicly exposed Node.js instances.”
- Researchers have demonstrated successful exploitation against unpatched Node.js environments.
“Researchers have demonstrated successful exploitation against unpatched Node.js environments.”
What undercuts it the paper’s own results
- Exploitability has only been shown for unpatched Node.js; other listed products (Bun, Envoy, Istio, etc.) have not been demonstrated vulnerable.
- Temporary mitigations such as disabling Brotli do not replace patching, indicating that full remediation is still required.
Stated limits 2
- Exploit demonstration is limited to Node.js; no public PoC for other affected products.
- Mitigation guidance notes that disabling Brotli is only a temporary measure and does not replace patching.
What’s new here 4
- Identification of CVE-2026-111497 (Broccoli2Shell) as an out-of-bounds write in the Brotli decoder.
- Proof-of-concept exploitation demonstrated against unpatched Node.js environments.
- Wiz telemetry showing 91% of cloud workloads contain vulnerable Brotli components.
- Comprehensive mitigation guidance, including patching, temporary disables, and detection recommendations.
Artifacts & methods 4
- Brotli C decoderprimitive
- CVE-2026-111497system
- Ron Masas exploit demonstrationevaluation
- Wiz telemetry datadataset