RHSB-2026-015 Out-of-Bounds Write - Google Brotli Decoder (CVE-2026-111497) - "node2shell"

Executive Summary

This issue has been assigned CVE-2026-111497 and has been rated with a severity impact of Important.

An out-of-bounds write vulnerability has been identified in the Google Brotli decoder. A crafted Brotli-compressed data stream can corrupt memory in any application that decompresses untrusted Brotli input, potentially leading to information disclosure, denial of service, or arbitrary code execution. Affected applications include web browsers (Firefox, Thunderbird), Node.js runtimes, web servers using the br HTTP content encoding, and any service that links against the brotli library and processes externally supplied data.

Environments where no application decompresses Brotli data from untrusted sources are not affected in practice. To determine exposure quickly:

• Check whether brotli, firefox, thunderbird, or nodejs packages are installed and accessible to untrusted input.
• Check whether any service accepts HTTP requests or responses with Content-Encoding: br from external or untrusted peers.
• Check whether any application passes user-supplied data to a Brotli decompression API (e.g., Node.js zlib.brotliDecompress(), fetch() with br encoding, or the brotli C library directly).

If none of these conditions apply, your environment is unlikely to be at risk.

The investigation is ongoing and this bulletin will be updated as new information emerges. Log in with your Red Hat account, then click the "Follow" button below to be notified of changes to this bulletin.

Affected Products

The following Red Hat product versions are directly affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 7

Red Hat is currently analyzing the impact on other products and this list will be updated as the investigation progresses.

Further, any Red Hat product which is supported on Red Hat Enterprise Linux (including RHEL CoreOS) is also potentially impacted. This includes

• Product containers that are based on the RHEL or UBI container images. These images are updated regularly, and container health indicating whether a fix to this flaw is available can be seen in the Container Health Index, part of the Red Hat Container Catalog. In addition, any customer containers should be rebuilt when the base images are updated.
• Products that pull packages from the RHEL channel (this includes layered products such as Red Hat OpenStack Platform, Red Hat Virtualization, and others). Please ensure that the underlying RHEL packages are current in these product environments.

Technical Summary

CVE-2026-111497 is an out-of-bounds write (CWE-787) in the Google Brotli decoder, carrying a CVSS v3.1 score of 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). A maliciously crafted Brotli-compressed stream can trigger a write outside the intended buffer boundary in the block-type switch handling logic of the decoder. When an application decompresses attacker-controlled Brotli data, the resulting memory corruption can lead to information disclosure, denial of service, or potentially arbitrary code execution.

Brotli is a lossless compression algorithm widely used for HTTP content encoding (the br transfer encoding). It is shipped in Red Hat Enterprise Linux as the standalone brotli package and is also embedded in Firefox, Thunderbird, Node.js, and various layered products.

Conditions

Exploitation requires that the target application decompress a Brotli-compressed stream supplied by the attacker. The vulnerable path is reached with a specifically malformed stream — typical well-formed encoder output does not trigger this issue. Common exposure scenarios include:

• HTTP servers or clients that negotiate Content-Encoding: br with untrusted peers
• Node.js applications using zlib.brotliDecompress(), zlib.createBrotliDecompress(), or fetch() to process Brotli-encoded responses
• Browsers (Firefox, Thunderbird) loading Brotli-compressed web content from untrusted sites
• Applications or services passing user-supplied data directly to the brotli C library

The Attack Complexity is High (AC:H), as exploitation requires supplying a precise malformed stream. By default, Red Hat products employ security hardening features — including ASLR, NX memory, FORTIFY_SOURCE, and SELinux — that further increase the difficulty of achieving reliable code execution.

Mitigation

Overall Guidance

Limit exposure of services that decompress Brotli from untrusted peers, and restrict network access to those services where practical. Prefer not accepting or auto-decoding Content-Encoding: br from untrusted sources when the application allows that configuration.

Product-Specific Mitigation Steps

Web-facing services and reverse proxies: Configure your reverse proxy or load balancer to strip or reject Content-Encoding: br on requests and responses from untrusted clients until the underlying brotli package is updated.

Node.js applications: Avoid calling zlib.brotliDecompress() or zlib.createBrotliDecompress() on data received from untrusted sources until the affected nodejs package is updated.

Firefox and Thunderbird: Avoid browsing untrusted sites until updated browser packages are available. Enterprise environments may consider restricting access to untrusted web content through existing proxy or firewall controls.

Technical Details

Background

Brotli is a lossless data compression algorithm developed by Google, widely adopted for HTTP content encoding under the br token (RFC 7932). It is distributed in Red Hat Enterprise Linux as the brotli package and as Python bindings (python-brotli, python3-brotli, python3.12-brotli). Firefox and Thunderbird embed their own copy for browser-side HTTP decompression. Node.js bundles brotli as part of its zlib module. JBoss Core Services ships it as jbcs-httpd24-brotli for use with the JBoss HTTP server.

Updates for Affected Products

Red Hat customers running affected versions of these Red Hat products are strongly recommended to update as soon as erratas are available. Customers are urged to apply the available updates immediately and enable the mitigations as they feel appropriate.

References

Upstream Node.js advisory

How to use GPG to verify signed content from Product Security