Technology
Brotli decoder flaw CVE-2026-111497 can leak memory or run arbitrary code
Hacker News reports that CVE-2026-111497, a critical Brotli decoder flaw scored 9.2, can leak memory or run code.
The short version
- NodeJS disclosed CVE-2026-111497, dubbed node2shell, on October 21, saying attacker-controlled Brotli data can leak memory or run arbitrary code.[Hacker News]
- The flaw is an out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0, rated 9.2 critical on CVSS v4.0.[Hacker News]
- According to the report, OpenAI says it discovered the vulnerability in February; this timeline is attributed, not independently verified.[Hacker News]
Key facts
- CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0 on all platforms.[Hacker News]
- CVE-2026-111497 carries a CVSS v4.0 score of 9.2, rated Critical.[Hacker News]
- NodeJS disclosed CVE-2026-111497, dubbed node2shell, on October 21; a Node.js process decompressing attacker-controlled Brotli data can leak memory or run arbitrary code.[Hacker News]
- Node.js is affected through its bundled Brotli library.[Hacker News]
- OpenAI states that it discovered this vulnerability in February.[Hacker News]
What remains uncertain
- The February discovery date rests on an OpenAI statement relayed by Hacker News and has not been independently confirmed.[Hacker News]
- Only one outlet, Hacker News, reports this event, so independent verification of the details is limited.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.