AIKIDO-2026-865696
compu-brotli-sys is vulnerable to Out-of-bounds Write
95
CVE Score
Critical
Out-of-bounds Write
TL;DR
The bundled Brotli decoder fails to reject invalid block switches when a stream declares only one block type. Decoding continues with inconsistent state and can write outside allocated memory. Crafted input can crash the process, expose memory, or potentially execute code.
How do I fix this?
Version 1.2.0 contains the fix but is yanked; 1.2.1 reintroduces the flaw. Retain 1.2.0 if already locked, or rebuild with the upstream Brotli fix or replace the dependency. Until then, avoid decoding untrusted Brotli data.
Who does this affect?
You are affected if you decode untrusted Brotli data with the bundled decoder in compu-brotli-sys. Custom builds depend on the Brotli source used.
Package
Versions
0.1.2 - 1.1.0
Fixed in 1.2.01.2.1 - 1.2.1
No fix availableBackground info
compu-brotli-sys is vulnerable to Out-of-bounds Write in versions 0.1.2 - 1.1.0 and 1.2.1 - 1.2.1.
Links
CVE Detail
GitHub Releases
github.com/andybalholm/brotli/releases/tag/v1.2.7github.com/google/brotli/releases/tag/v1.0.10github.com/google/brotli/releases/tag/v1.1.1github.com/google/brotli/releases/tag/v1.2.1Related Issue
Other
crates.io/crates/compu-brotli-sys/1.2.0nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---highopenwall.com/lists/oss-security/2026/10/23/25openwall.com/lists/oss-security/2026/10/24/6openwall.com/lists/oss-security/2026/10/26/12openwall.com/lists/oss-security/2026/10/26/13openwall.com/lists/oss-security/2026/10/26/16openwall.com/lists/oss-security/2026/11/03/2broccoli2shell.comlists.debian.org/debian-lts-announce/2026/10/msg00049.htmlpatchtheplanet.org/brotliaikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497cert-portal.siemens.com/productcert/html/ssa-045512.htmlcert-portal.siemens.com/productcert/html/ssa-443410.htmlcert-portal.siemens.com/productcert/html/ssa-898633.htmlellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.