Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

CVE-2026-111497, a CVSS 9.2-rated out-of-bounds write vulnerability in Google's Brotli decoder library, enables remote code execution and memory leaks simply by processing attacker-controlled compressed data — a capability present in an enormous number of applications and runtimes. The core problem is that Brotli is deeply embedded in ecosystems like Node.js and .NET, and many applications bundle their own private copies of the library, meaning a single upstream patch does not automatically protect every dependent application. This supply-chain-style distribution of the vulnerable component dramatically widens the attack surface and complicates remediation. Organizations that lack a complete software bill of materials (SBOM) or automated dependency tracking will struggle to identify every affected asset before attackers exploit them.