Brotli flaw CVE-2026-111497 exploited: what to update

A flaw in Brotli, tracked as CVE-2026-111497, is now being used in real attacks. The US cyber agency CISA added it to its list of exploited flaws on 27 October 2026. Brotli is built into a lot of software, so the fix arrives through many separate updates. Update Git, .NET, your browsers and any Linux server you run yourself this week.

You may also see this flaw called HTTP2Shell, Node2Shell or Brotli2Shell in the news. These are nicknames for the same CVE-2026-111497, and despite the first name it has nothing to do with the HTTP/2 protocol.

What is Brotli?

Brotli is a way of squeezing data so it downloads faster. Google created it, and most websites now send their pages to your browser in Brotli form. The browser, or any other program that fetches web content, then unpacks it.

The flaw sits in the unpacking part. A server or file that sends a deliberately broken Brotli stream can make the program write outside the memory it should use. Red Hat says this can crash the program, leak data from memory or, in the worst case, let an attacker run their own code. Google fixed it in Brotli 1.2.1 on 21 October, with fixed 1.0.10 and 1.1.1 releases for older lines. Versions 1.0.3 to 1.2.0 are affected.

Which software is affected?

Any program that unpacks Brotli data from the internet and carries an old copy of the library. The sources name these:

• Git. A security researcher reported on the Openwall list that Git's HTTPS downloads are affected when the curl library inside Git was built with Brotli, which is the usual case. Git for Windows released version 2.56.0.windows.4 on 26 October to fix it.
• curl and programs built on it, on Linux in particular, where the system Brotli library is shared by many tools.
• Microsoft .NET 8, 9, 10 and 11, Visual Studio and PowerShell 7. Microsoft released fixes on 25 October and rates the flaw Critical for .NET.
• Firefox and Thunderbird. Red Hat lists fixed 140.10.0 builds.
• Node.js 22, 24 and 26, and Python Brotli packages, for anyone running their own web apps.

Posts on Openwall also list PDF and archive tools that carry their own copy, such as Ghostscript, MuPDF, SumatraPDF, 7-Zip-zstd and NanaZip. Check those for updates too if your staff use them.

What to do

1. Windows PCs. Run Windows Update and install everything offered, including the .NET updates. If your staff use Git for Windows, install 2.56.0.windows.4 or newer.
2. Macs. Install macOS updates, then update any developer tools such as .NET, Git and Node.js.
3. Browsers and mail apps. Close and reopen Chrome, Edge and Firefox so the latest version loads. Update Thunderbird if you use it.
4. Your own Linux servers or VPS. Install the vendor's brotli update (for example Red Hat RHSA-2026:90501 on RHEL 8), then restart the services that use it. A running program keeps the old library in memory until it restarts, so a package update alone is not enough.
5. Your own apps. Ask your developer to update Node.js and any Brotli package in the app, then redeploy.
6. Leave automatic updates on, so the next fix arrives without anyone having to remember.

If an outside company looks after your PCs or servers, forward this page to them and ask them to confirm the updates are done.

How SyncTech can help

If you are not sure your website software is up to date, our website updates and checks service covers this for you.

Updated 3 Nov 2026: added the other names (HTTP2Shell, Node2Shell, Brotli2Shell) the news uses for this flaw.

Source and credit

We are sharing this news from CISA, Red Hat, Google, Microsoft, Git for Windows, Wordfence and the Openwall oss-security list. This summary is written by Synctech in our own words.

• Known Exploited Vulnerabilities Catalog, entry CVE-2026-111497 (added 27 October 2026), CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111497
• CVE-2026-111497, Red Hat Customer Portal, 22 October 2026: https://access.redhat.com/security/cve/CVE-2026-111497
• RHSA-2026:90501 brotli security update, Red Hat, 26 October 2026: https://access.redhat.com/errata/RHSA-2026:90501
• Brotli v1.2.1 release notes, Google, 21 October 2026: https://github.com/google/brotli/releases/tag/v1.2.1
• CVE-2026-111497 security update guide, Microsoft, 25 October 2026: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
• Git for Windows v2.56.0.windows.4 release notes, Git for Windows, 26 October 2026: https://github.com/git-for-windows/git/releases/tag/v2.56.0.windows.4
• Brotli CVE-2026-111497 and git-remote-https, oss-security list, 26 October 2026: https://www.openwall.com/lists/oss-security/2026/10/26/16
• Re: Brotli CVE-2026-111497, oss-security list, 25 October 2026: https://www.openwall.com/lists/oss-security/2026/10/26/12
• HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites, Wordfence, 2 November 2026: https://www.wordfence.com/blog/2026/11/http2shell-wordpress-brotli/

Retrieved 28 October and 3 November 2026. Brotli, Google, Chrome, Microsoft, Windows, .NET, Visual Studio, PowerShell, Edge, Red Hat, Git, Firefox, Thunderbird, Node.js and the other product names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.