ApplyDjinn digest · AI assisted
Broccoli2Shell / Node2Shell / HTTP2Shell: CVE-2026-111497 Explained
Overview
Cynet describes Broccoli2Shell, also called Node2Shell and HTTP2Shell, as CVE-2026-111497, a critical out-of-bounds write in Google’s Brotli decompression library rated 9.2 on CVSS v4.0. Crafted compressed data can overwrite process memory. Depending on the app, attackers might crash a service, read sensitive information, or run code without authentication.
Key facts
- Exposure can come from decompressing untrusted requests or responses fetched from external servers in affected Brotli versions.
- Node.js, Python, .NET, Bun, Envoy, and Istio have listed fixed releases; ClickHouse, DuckDB, and Apache Arrow had no patched release yet.
- Cynet advises identifying affected deployments, updating to fixed or later supported versions, and restarting services.
Key figures
- 9.2 — CVSS v4.0 score for the Brotli decoder out-of-bounds write
- 1.0.3–1.0.9, 1.1.0 — affected upstream Brotli releases named in the advisory
- 1.0.10, 1.1.1, 1.2.1 — first fixed Brotli releases named by the advisory
- 22.23.4; 24.22.1; 26.12.1 — fixed Node.js releases in the supported lines
- October 21, 2026 — date of the Node.js and Google Brotli security releases
- February 2026 — month the Brotli source fix first landed, per cited analysis
Context
Cynet Research is tracking exploitation techniques, published indicators, and reported activity.
What remains uncertain
The article will be updated as further technical details are verified. Unsupported Node.js lines received no security release.
A concise AI-assisted digest of selected facts. The original publication may contain additional detail and later updates. Company data below is a separate ApplyDjinn observation.
Request a correction or removalApplyDjinn context
What else is visible for Cynet Security?
These are observations in our catalog around the company, not claims made by the article. A publication does not establish why hiring, search interest, or share prices moved.
Current roles
3
30-day current-market scope
Company stories · 30d
6
6 official · 0 independent
Attention records · 7d
0
0 Google · 0 Polymarket
Coverage mix
Attention sources
No matching record in this window.
Open roles
3
Technical roles
0 of 3
Observed hiring change
-10 roles
Hiring and market history
Daily vacancy snapshots show this company’s observed hiring; no standalone public ticker is assigned.
Vacancy history
Current role mix
0 technical · 3 other
0% of currently observed roles are technical.
Vacancy history uses saved daily snapshots through 2026-11-01. News counts are dated publications; attention counts are matched records, not search volume or prediction probabilities.