Broccoli2Shell CVE-2026-111497: Emergency .NET and Node.js Brotli Patch Stops Pre-Auth RCE

The Broccoli2Shell exploit path begins at the HTTP layer and ends at the heap. An attacker sends a POST or PUT request to any endpoint that decompresses Brotli-encoded request bodies -- no authentication, session token, or application-specific knowledge required.

The crafted Brotli stream contains a block-type switch instruction with an invalid value. In the affected versions of Google's libbrotlidec, the function DecodeBlockTypeAndLength() evaluates the switch and returns a plain boolean indicating success or failure. Calling code does not check the return value (CWE-252). When the switch is invalid, the function exits without draining the decoder's small internal input buffer. The decoder then continues, writing decompressed output past the end of that buffer (CWE-787). What gets overwritten depends on heap layout: in the best case for defenders, the process crashes with a segmentation fault; in the worst case, the overwritten region is adjacent to a heap structure that can be shaped into a code-execution primitive.

ELLIO researchers confirmed the latter case on an official, unmodified Node.js x86-64 binary. They obtained an interactive shell using a malformed Brotli body without modifying the server binary, disabling ASLR, or requiring any server-side state. Brandefense separately confirmed RCE on x86-64 with ASLR enabled and display_errors disabled.

The fix in Brotli 1.0.10, 1.1.1, and 1.2.1 makes DecodeBlockTypeAndLength() return the enum constant BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (numeric value -17) on invalid transitions. Calling code now receives a typed error rather than an ambiguous boolean, and decompression halts cleanly instead of writing past the buffer.

No special tool or skill is required to trigger the vulnerability. Any HTTP client -- curl, a browser, a custom script -- can send a Brotli-encoded body. The attacker's only constraint is reaching an endpoint that processes compressed request bodies, which for Node.js Express 5 and Python aiohttp is any POST endpoint with Brotli support compiled in.

Internal link: PHP2Shell CVE-2026-109618 followed a similar unchecked-return-value pattern in PHP's request handling, demonstrating that memory-management bugs in widely-deployed runtime components reliably produce pre-auth RCE.

CVE-2026-111497 affects any application that decompresses Brotli data using the vulnerable Google libbrotlidec C library. The table below shows affected and fixed versions across the major ecosystems. Note that .NET Framework is not affected -- only the cross-platform .NET runtime (formerly .NET Core) bundles libbrotlidec.

For .NET applications: exposure requires explicit use of BrotliDecoder, BrotliStream, or request decompression middleware. ASP.NET Core does not enable Brotli request decompression by default, but you should update regardless to close the library-level risk. For Node.js: all Express 5 and body-parser 2.x applications process Brotli-encoded request bodies when the Content-Encoding header is present -- no application-level configuration needed for exposure.

Enterprise Java and Go applications are not directly affected unless they explicitly shell out to libbrotlidec. Ruby's brotli gem links against the system libbrotlidec, so update the system package as well as the gem.

OpenAI's Codex Security team discovered CVE-2026-111497 during internal security research on HTTP compression libraries. OpenAI followed responsible disclosure procedures, reporting the flaw to Google's security team before public disclosure.

The public timeline exposes a significant gap between the Brotli library fix and the .NET ecosystem patch:

October 13, 2026: Microsoft's Patch Tuesday included updates for hundreds of CVEs but did not fully remediate CVE-2026-111497 in the .NET runtime. Several security researchers noted post-Patch-Tuesday that the vulnerable Brotli decoder remained present in updated .NET installations.

October 21, 2026: Google shipped Brotli 1.0.10, 1.1.1, and 1.2.1, fixing the out-of-bounds write. Downstream runtimes began their own patching processes.

October 25, 2026: Microsoft shipped emergency out-of-band security updates for .NET 8 (8.0.33), .NET 9 (9.0.22), .NET 10 (10.0.14), and .NET 11 RC3. The out-of-band release -- unusual for Microsoft outside of Patch Tuesday cycles -- signals the severity and exploitation risk Microsoft assigned to this flaw.

October 26, 2026: Node.js shipped fixed versions 22.23.4, 24.22.1, and 26.12.1. Python's brotli and brotlicffi packages also received fixed releases.

The flaw was separately documented as Node2Shell when Node.js researchers explored it and HTTP2Shell when the HTTP transport layer was emphasized. Broccoli2Shell became the cross-ecosystem tracking name at broccoli2shell.com.

The October Patch Tuesday failure is a particular concern: organizations relying on their standard patch cadence to address the flaw will have remained exposed for nearly two weeks after the Microsoft October 13 patch wave, assuming they did not separately update the Brotli library.

A related developer supply chain risk: the LiteLLM PyPI compromise on October 21, 2026 demonstrates that Python ecosystem attacks are active right now -- update Python dependencies in a controlled process and verify integrity of pip-installed packages.

CVE-2026-111497 does not produce network-layer IOCs such as C2 domains or IP addresses. Compromise indicators are behavioral: anomalous process spawning from web worker processes, unexpected writes to temp directories, and abnormal memory access patterns.

No confirmed in-the-wild attacks have been reported as of October 27, 2026. The indicators below are derived from the confirmed exploit chain documented by researchers and represent the artifacts an attacker would produce after successfully triggering the out-of-bounds write and gaining code execution.

Defend against pre-exploitation by monitoring HTTP requests with the Content-Encoding: br header for oversized or malformed bodies. Any Brotli-encoded request body exceeding 64 MB without a corresponding legitimate application workflow warrants investigation. Post-exploitation detection depends on catching the child process spawned by the web worker.

These two rules cover the primary post-exploitation indicator (web process spawning a shell) and a persistence pattern (web process writing executables to user-writable directories). Both carry experimental status; validate against your environment before enabling automatic blocking. Deploy in alert-only mode first to baseline legitimate activity from your .NET, Node.js, and Python web services.

These steps address both the immediate patching requirement and interim mitigations for systems that cannot be updated immediately. Mitigations without patching reduce exploitation risk but do not eliminate the underlying vulnerability.

Broccoli2Shell is not a niche language runtime bug -- it is a supply-chain risk embedded in the HTTP stack of seven major ecosystems simultaneously. The vulnerability sits in libbrotlidec, a C library authored by Google and bundled by .NET, Node.js, Python, PHP, Ruby, curl, and GraalVM without independent security review. A single bug in that shared dependency exposes applications across every cloud provider, on-premises data center, and edge deployment simultaneously.

The enterprise attack surface is broad. ASP.NET Core applications represent a significant share of enterprise web APIs, particularly in financial services, healthcare, and government. Node.js powers the majority of modern API gateways, serverless functions, and microservice frontends. Any of these services accepting Brotli-encoded HTTP request bodies -- a configuration that Express 5 enables by default -- is exposed to pre-authentication RCE until patched.

The out-of-band emergency patch release is significant. Microsoft ships out-of-band patches for a narrow category of flaws: those where the exploitation risk is severe enough that waiting until the next Patch Tuesday is unacceptable. The standard Patch Tuesday cycle would not have delivered the fix until November 11, 2026 -- two weeks after the Brotli fix was available and after public PoC references began circulating.

Container environments compound the risk. Organizations running containerized .NET or Node.js workloads must update base images and rebuild all derived containers; patching the host OS alone leaves container workloads unexposed. CI/CD pipelines that pin Node.js or .NET base image digests rather than tracking security releases will remain vulnerable until those digests are updated.

This is the second time in October 2026 that a library-level vulnerability in a widely-bundled runtime component created pre-auth RCE at scale -- the PHP2Shell CVE-2026-109618/109619 chain followed the same pattern two weeks earlier. Runtime vendors need continuous dependency auditing, not reactive patching, to prevent shared libraries from becoming systemic liabilities.