Critical Severity
CVE-2026-111497
Published: Oct 25, 2026
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.
# CVE-2026-111497: Node2Shell / Broccoli2Shell — Security Research Lab & PoC
<p align="center">
<img src="https://img.shields.io/badge/CVE-2026--111497-critical?style=for-the-badge&logo=shield&logoColor=white&color=e11d48" alt="CVE-2026-111497">
<img src="https://img.shields.io/badge/CVSS%204.0-9.2%20CRITICAL-red?style=for-the-badge&color=dc2626" alt="CVSS 9.2">
<img src="https://img.shields.io/badge/Exploit-RCE%20Verified-success?style=for-the-badge&color=16a34a" alt="RCE Verified">
<img src="https://img.shields.io/badge/Affected-Node.js%20%7C%20Bun%20%7C%20Python-blue?style=for-the-badge&color=2563eb" alt="Affected Platforms">
<img src="https://img.shields.io/badge/License-MIT-gray?style=for-the-badge" alt="MIT License">
</p>
A comprehensive research lab and exploit reproduction toolkit for **CVE-2026-111497** (also known as **Node2Shell**, **Broccoli2Shell**, or **HTTP2Shell**), a critical vulnerability in Google's Brotli compression reference decoder (`c/dec/decode.c`) embedded into the Node.js runtime and other software ecosystems.
<p align="center">
<img src="assets/showcase.gif" alt="CVE-2026-111497 Exploit Demonstration" width="850">
</p>
---
## 1. Technical Analysis (Root Cause Analysis)
### Vulnerability Overview
- **Component:** Google Brotli Reference Decoder (`c/dec/decode.c`)
- **Affected Versions:** `1.0.3` – `1.2.0` (Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1; Bun < 1.4.4; PyPI `brotli` < 1.2.1)
- **Vulnerability Class:** CWE-787: Out-of-bounds Write / CWE-252: Unchecked Return Value
- **CVSS Score:** 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H)
### Defect Mechanics
1. **Ambiguous Return Semantics:**
In the reference Brotli decoder, `DecodeBlockTypeAndLength()` returned a boolean `BROTLI_BOOL`:
- `BROTLI_TRUE` (1) — block switch processed successfully;
- `BROTLI_FALSE` (0) — overloaded to represent two mutually exclusive scenarios: **insufficient input stream data** (`BROTLI_DECODER_NEEDS_MORE_INPUT`)