Not Just Node.js: Brotli Library Vulnerability Affects Python, Go, and More; CVSS Score 9.2

Australian tech media outlet iTnews reported that the recently patched high-risk vulnerability in Node.js, known as Node2Shell (CVE-2026-111497), actually stems from Google's Brotli compression library. While Node.js is affected because it embeds this component, Paul McCarty, co-founder and CTO of security firm OpenSourceMalware, discovered that libraries and applications in Python, Go, .NET, and Perl ecosystems also use Brotli, as do browsers, desktop applications, and infrastructure software. This indicates the vulnerability's impact extends far beyond Node.js itself.

McCarty noted that the Python packages Brotli and brotlicffi have been confirmed to use the affected decoder, with patched versions released on October 22 and 23, respectively. Products like Chrome, Firefox, and Envoy have also addressed related issues. However, since some products embed the Brotli library directly, enterprises may still have other software using unpatched versions even after updating Node.js or OS packages. Whether a system is affected depends on the specific version of Brotli used and whether it decompresses untrusted data.

The vulnerability lies in the decoder responsible for decompressing data in Brotli. If an attacker can trick an application using an affected version into decompressing specially crafted data, it could trigger an out-of-bounds write, leading to memory corruption or even remote code execution. The CVSS 4.0 risk score is 9.2. Security firm Miggo traced the vulnerability history and found that the problematic code was added to Brotli on February 26, 2018. Although the upstream project corrected the relevant code on February 27, 2026, it was not identified as a security vulnerability at the time, and the official release containing the fix was only published on October 21. This time gap demonstrates that fixing upstream code does not mean dependent software has automatically received the patch.