AIKIDO-2026-562225
IronCompress is vulnerable to Out-of-bounds Write
95
CVE Score
Critical
Out-of-bounds Write
TL;DR
The bundled Brotli decoder fails to reject invalid block switches when a stream declares only one block type. Decoding continues with inconsistent state and can write outside allocated memory. Crafted input can crash the process, expose memory, or potentially execute code.
How do I fix this?
No patched IronCompress native release is available. Until one is deployed, do not decode untrusted Brotli data with the bundled native backend. Where supported, use BrotliStream on a patched runtime, or replace or rebuild the native decoder with the upstream fix. The .NET Standard 2.0 build requires a native decoder fix.
Who does this affect?
You are affected if you decode untrusted Brotli data with IronCompress's native backend, including the .NET Standard 2.0 build or when UseNativeBrotli is enabled. The BrotliStream backend depends on your runtime's security updates.
Package
Versions
1.2.5 - 1.7.0
No fix availableBackground info
IronCompress is vulnerable to Out-of-bounds Write in versions 1.2.5 - 1.7.0.
Links
CVE Details
GitHub Releases
github.com/andybalholm/brotli/releases/tag/v1.2.7github.com/google/brotli/releases/tag/v1.0.10github.com/google/brotli/releases/tag/v1.1.1github.com/google/brotli/releases/tag/v1.2.1Related Issue
Other
nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---highopenwall.com/lists/oss-security/2026/10/23/25openwall.com/lists/oss-security/2026/10/24/6openwall.com/lists/oss-security/2026/10/26/12openwall.com/lists/oss-security/2026/10/26/13openwall.com/lists/oss-security/2026/10/26/16openwall.com/lists/oss-security/2026/11/03/2broccoli2shell.comlists.debian.org/debian-lts-announce/2026/10/msg00049.htmlpatchtheplanet.org/brotliaikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497cert-portal.siemens.com/productcert/html/ssa-045512.htmlcert-portal.siemens.com/productcert/html/ssa-443410.htmlcert-portal.siemens.com/productcert/html/ssa-898633.htmlellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.