Brotli flaw: four nicknames, one CVE, a decoder in every stack

One flaw, four nicknames, and a fix that must be applied dozens of times. CVE-2026-111497 is an out-of-bounds write in the C decoder of Google's Brotli compression library, disclosed on October 21, 2026 by Node.js. It reaches hotel estates through a plain mechanism: vendors embed their own copies of Brotli, so each copy needs its own fix. Node.js, .NET, two Python packages, Bun, Envoy and Istio have shipped patched releases; telephony and building-systems vendors are still mapping products. The useful question is no longer which software is affected, but where a Brotli decoder runs, and which build it is.

Four names, one bug

Four names circulate for the same bug. Imperva Red Team published its analysis under Node2Shell; Mitel even carries node2shell in the title of advisory MISA-2026-0010. HTTP2Shell reflects the bug's reach into HTTP clients and servers beyond Node.js; Johnson Controls titled its advisory JCI-PSA-2026-31 "HTTP2Shell", though BleepingComputer notes the flaw is not specific to HTTP/2. Tenable chose Brotli2Shell because the bug sits in the decoder itself, not in any one downstream product. Broccoli2Shell comes from the community tracker broccoli2shell.com, and the Canadian Centre for Cyber Security uses it in alert AL26-027.

For compliance work, only the constant matters: search advisories, contracts and attestations for CVE-2026-111497, whose official record name is "Google Brotli Unchecked Return Value Vulnerability". Google, as numbering authority, scores it 9.2 critical under CVSS v4.0. CISA added the entry to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, with a November 10, 2026 federal due date under Binding Operational Directive 26-04. The directive binds only US federal civilian agencies; for a private operator it is a defensible yardstick.

One bug, dozens of copies

The mechanism is short: a crafted Brotli stream reports an invalid block switch as a temporary need for more input instead of a permanent format error, and the streaming decoder keeps appending bytes to an eight-byte internal buffer past its bounds, as Node.js explains. Two routes carry hostile data to that code: a compressed HTTP response the application fetches, and a compressed request body it unpacks.

The fix timeline is unusual: Google committed the patch on February 27, 2026, without a release or advisory, and it sat publicly readable for eight months before the coordinated wave of October 21, which shipped Brotli 1.0.10, 1.1.1 and 1.2.1 with Node.js 22.23.4, 24.22.1 and 26.12.1. Python's Brotli 1.2.1 and brotlicffi 1.2.1.0 reached PyPI on October 22; Microsoft pushed an emergency .NET, Visual Studio and PowerShell update on October 25; Envoy and Istio had shipped fixes earlier in October without naming the flaw; PHP's official Windows builds were rebuilt on October 26.

The trap, documented by Tenable: updating the operating system's Brotli library does nothing for software that ships its own copy, as Node.js and Bun do. Exposure is then conditional. A .NET application is not exposed merely because the package is installed, Microsoft notes: request and response decompression are off by default; Envoy is at risk only when its Brotli decompressor filter is configured. Node.js web services are the loud case: Imperva worked against Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0, which decode Brotli request bodies, and node:zlib decodes natively. Lines 20.x, 23.x and 25.x are end of support and get no fix: running one means migrating, not patching.

Three estates in a hotel

Booking engines, PMS (property management system) web front ends and guest portals form the first estate, a heavily Node.js world that includes the SaaS layer of chatbots and channel managers. The runtime is the vendor's, not yours. Ask each editor in writing: which fixed release runs in production, and were container images rebuilt, since nothing changes until processes restart and images redeploy.

Telephony forms the second. Mitel's advisory for this flaw is MISA-2026-0010; revision 3.0 (October 30) leaves one product affected, OpenScape Endpoint Management up to V1 R2.5.1, update planned, risk rated low when deployed per Mitel guidelines, while several lines remain under investigation. Two precautions: MISA-2026-0010 covers a different flaw family from MISA-2026-0008, the php2shell advisory, and the matrices must not be merged; and demand the revision number before relaying status, since vendor pages can serve stale copies. This article read revision 3.0.

Building automation and access control form the third. Johnson Controls published JCI-PSA-2026-31 v2 on October 30, listed as "HTTP2Shell" general guidance on CVE-2026-111497. The per-product detail is not freely readable: the matrix download sits behind a consent wall. Properties running Metasys, Kantech or American Dynamics should not wait for a public matrix: request the integrator's product-by-product assessment in writing and keep it with the change records.

What patched means now

Public proof-of-concept exploits sit on GitHub. Imperva demonstrated code execution on the official Node.js 24.22.0 image after multiple attempts; version 24.22.1 rejects the same inputs. ELLIO recorded exploitation attempts in the wild, which Tenable has not independently confirmed. Interim measures narrow the window without closing it: blocking inbound Content-Encoding: br at the proxy does nothing for responses fetched from a hostile server, dropping br from Accept-Encoding falls short because a hostile server can answer in Brotli anyway, and disabling the decompressor in Envoy forwards the compressed bytes downstream to whatever decodes them.

The nicknames will fade; the CVE and the dates will not. The question that settles every argument, property by property: which build of the Brotli decoder runs in this process, and has it restarted since the fix.