# Python2Shell: Brotli decoder out-of-bounds write in PyPI Brotli/brotlicffi (CVE-2026-111497)

> A memory-safety flaw in the Brotli C decoder's DecodeBlockTypeAndLength() conflates 'malformed stream' with 'need more input', letting a crafted Brotli stream drive out-of-bounds writes. Python apps using urllib3/requests, httpx, aiohttp or Scrapy are exposed whenever Brotli or brotlicffi is installed, even without explicit Brotli imports. Fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0; no in-the-wild exploitation reported.

- **Published:** 2026-10-23T22:21:36Z
- **Last reviewed:** 2026-10-23T22:21:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4315
- **ID:** TL-2026-4315
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497

## Description

CVE-2026-111497 (nicknamed Node2Shell for Node.js and Python2Shell for the Python packages) is an unchecked-return-value (CWE-252) bug leading to an out-of-bounds write (CWE-787) in Google's Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns a plain BROTLI_BOOL, so BROTLI_FALSE can mean either 'this stream is malformed' or 'I need more input'. Block-switch callers treated the result as recoverable, and the fast decode path discarded it entirely, so decoding continued with invalid internal state and wrote past the ring buffer. The CVE record places the bug in Brotli 1.0.3 through 1.2.0 (fixed in 1.0.10, 1.1.1 and 1.2.1). The upstream fix makes the function return an error code and adds BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17).

In the Python ecosystem the PyPI packages Brotli (<=1.2.0) and brotlicffi (<=1.2.0.x) bundle the vulnerable decoder. Aikido and OpenSourceMalware report that HTTP clients automatically decode Brotli responses when these packages are installed: urllib3/requests, httpx (brotli extra), aiohttp and Scrapy. Any service that fetches attacker-influenced URLs (webhooks, URL previews, crawlers, proxies) can therefore receive a malicious Content-Encoding: br response, and frameworks that accept Content-Encoding: br request bodies are reachable inbound. OpenSourceMalware testing showed that crafted streams made vulnerable 1.2.0 decoders report NEEDS_MORE_INPUT on complete payloads, while patched versions return ERROR -17 FORMAT_BLOCK_SWITCH. Brotli on PyPI has roughly 82.8 million monthly downloads. Neither package's release notes mention the vulnerability, and as of 2026-10-23 pip-audit, Dependabot and Safety did not yet flag the affected versions.

Impact ranges from process crashes and memory disclosure to potential remote code execution in the process context. Public exploitation work so far targets Node.js: Imperva published a working RCE PoC (Node.js 24.22.0 on Linux arm64, via fetch() responses and Express 5.0.0-5.3.0 / body-parser 2.0.0-2.3.0 request bodies; reliability required multiple attempts), and Vercel reports researchers achieved memory disclosure and command execution. No public PoC specific to the Python packages and no in-the-wild exploitation or attribution were reported in the sources reviewed. Node.js shipped fixes (22.23.4, 24.22.1, 26.12.1) on 2026-10-21; Brotli 1.2.1 reached PyPI on 2026-10-22 and brotlicffi 1.2.1.0 on 2026-10-23.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1499.004 Application or System Exploitation

## Sources

- [Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497) - Aikido](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)
- [Python Packages Vulnerable to Node2Shell - OpenSourceMalware](https://opensourcemalware.com/blog/node2shell-affects-python)
- [GitHub Advisory GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35)
- [Node2Shell: From Brotli Data to Remote Code Execution - Imperva](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
- [Node.js Brotli Decoder Out-of-Bounds Write (RCE) - OX Security](https://www.ox.security/blog/node-js-brotli-decoder-out-of-bounds-write-rce-cve-2026-111497/)
- [Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) - Vercel](https://vercel.com/kb/bulletin/node-js-security-advisory)
- [Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept - Cyber Kendra](https://www.cyberkendra.com/2026/10/nodejs-october-2026-security-releases-cve-2026-111497.html)
- [Node2Shell: Fixed Node.js Versions and Check - Brandefense](https://brandefense.io/blog/node2shell-nodejs-brotli-rce-cve-2026-111497/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4315