{"schema":"vulnpedia.research/1","cve":"CVE-2026-111497","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","tags":["patch","WEB","vendor-reference"],"source":"mitre","sourceId":"Google","modified":"2026-10-23T14:25:46.551Z","origins":[{"source":"mitre","sourceId":"Google","modified":"2026-10-23T14:25:46.551Z","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"source":"nvd","sourceId":"CVE-2026-111497","modified":"2026-10-24T18:16:47.170","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"}]},{"url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"},{"source":"nvd","sourceId":"CVE-2026-111497","modified":"2026-10-24T18:16:47.170","url":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/25","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"http://www.openwall.com/lists/oss-security/2026/10/23/25"},{"source":"nvd","sourceId":"CVE-2026-111497","modified":"2026-10-24T18:16:47.170","url":"http://www.openwall.com/lists/oss-security/2026/10/23/25"}]},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"},{"source":"nvd","sourceId":"CVE-2026-111497","modified":"2026-10-24T18:16:47.170","url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/6","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"http://www.openwall.com/lists/oss-security/2026/10/24/6"},{"source":"nvd","sourceId":"CVE-2026-111497","modified":"2026-10-24T18:16:47.170","url":"http://www.openwall.com/lists/oss-security/2026/10/24/6"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/12","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"http://www.openwall.com/lists/oss-security/2026/10/26/12"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/26/13","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"http://www.openwall.com/lists/oss-security/2026/10/26/13"}]},{"url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"}]},{"url":"https://broccoli2shell.com/","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://broccoli2shell.com/"}]},{"url":"https://github.com/dotnet/announcements/issues/494","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://github.com/dotnet/announcements/issues/494"}]},{"url":"https://github.com/google/brotli/releases/tag/v1.2.1","tags":["WEB"],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/releases/tag/v1.2.1"}]},{"url":"https://github.com/google/brotli/releases/tag/v1.1.1","tags":["WEB"],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://github.com/google/brotli/releases/tag/v1.1.1"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/releases/tag/v1.1.1"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/releases/tag/v1.1.1"}]},{"url":"https://github.com/google/brotli/releases/tag/v1.0.10","tags":["WEB"],"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-26T04:03:35.751Z","url":"https://github.com/google/brotli/releases/tag/v1.0.10"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/releases/tag/v1.0.10"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/releases/tag/v1.0.10"}]},{"url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"}]},{"url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b","tags":["WEB","FIX"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"},{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"},{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"}]},{"url":"https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0"}]},{"url":"https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6"}]},{"url":"https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111497","tags":["WEB","ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"}]},{"url":"https://pypi.org/project/brotlicffi","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://pypi.org/project/brotlicffi"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://pypi.org/project/brotlicffi"}]},{"url":"https://pypi.org/project/Brotli","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://pypi.org/project/Brotli"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://pypi.org/project/Brotli"}]},{"url":"https://opensourcemalware.com/blog/node2shell-affects-python","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://opensourcemalware.com/blog/node2shell-affects-python"},{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://opensourcemalware.com/blog/node2shell-affects-python"},{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://opensourcemalware.com/blog/node2shell-affects-python"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://opensourcemalware.com/blog/node2shell-affects-python"}]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml"}]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml"}]},{"url":"https://github.com/google/brotli","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://github.com/google/brotli"},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://github.com/google/brotli"}]},{"url":"https://osv.dev/vulnerability/PYSEC-2026-4322","tags":["ADVISORY"],"source":"pysec","sourceId":"PYSEC-2026-4322","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://osv.dev/vulnerability/PYSEC-2026-4322"},{"source":"pysec","sourceId":"PYSEC-2026-4322","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/PYSEC-2026-4322"}]},{"url":"https://pypi.org/project/Brotli/","tags":["PACKAGE"],"source":"pysec","sourceId":"PYSEC-2026-4322","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://pypi.org/project/Brotli/"},{"source":"pysec","sourceId":"PYSEC-2026-4322","modified":"2026-10-24T10:55:42.890666980Z","url":"https://pypi.org/project/Brotli/"}]},{"url":"https://osv.dev/vulnerability/PYSEC-2026-4323","tags":["ADVISORY"],"source":"pysec","sourceId":"PYSEC-2026-4323","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://osv.dev/vulnerability/PYSEC-2026-4323"},{"source":"pysec","sourceId":"PYSEC-2026-4323","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/PYSEC-2026-4323"}]},{"url":"https://pypi.org/project/brotlicffi/","tags":["PACKAGE"],"source":"pysec","sourceId":"PYSEC-2026-4323","modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://pypi.org/project/brotlicffi/"},{"source":"pysec","sourceId":"PYSEC-2026-4323","modified":"2026-10-24T10:55:42.890666980Z","url":"https://pypi.org/project/brotlicffi/"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-111497"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973"}]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-015","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-015"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87420","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87420"}]},{"source":"euvd","sourceId":"EUVD-2026-108169","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108169","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-108169","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108169"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35","ecosystem":"PyPI","name":"brotli","purl":"pkg:pypi/brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1"}]}],"versions":["1.0.4","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.2.0"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json"},"modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35"}]},{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35","ecosystem":"PyPI","name":"brotlicffi","purl":"pkg:pypi/brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.3"},{"fixed":"1.2.1.0"}]}],"versions":["1.0.9.0","1.0.9.1","1.0.9.2","1.1.0.0","1.2.0.0","1.2.0.1","1.2.0.2"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json"},"modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"ghsa","sourceId":"GHSA-9v8h-qqgm-4m35","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/GHSA-9v8h-qqgm-4m35"}]},{"source":"pysec","sourceId":"PYSEC-2026-4322","url":"https://osv.dev/vulnerability/PYSEC-2026-4322","ecosystem":"PyPI","name":"brotli","purl":"pkg:pypi/brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["0.5.2","0.6.0","1.0.1","1.0.4","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.2.0"],"databaseSpecific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/brotli/PYSEC-2026-4322.yaml"},"modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4322","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/PYSEC-2026-4322"}]},{"source":"pysec","sourceId":"PYSEC-2026-4323","url":"https://osv.dev/vulnerability/PYSEC-2026-4323","ecosystem":"PyPI","name":"brotlicffi","purl":"pkg:pypi/brotlicffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1.0"}]}],"versions":["0.8.0","1.0.9.0","1.0.9.1","1.0.9.2","1.1.0.0","1.2.0.0","1.2.0.1","1.2.0.2"],"databaseSpecific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/brotlicffi/PYSEC-2026-4323.yaml"},"modified":"2026-10-24T10:55:42.890666980Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-4323","modified":"2026-10-24T10:55:42.890666980Z","url":"https://osv.dev/vulnerability/PYSEC-2026-4323"}]}],"pocCandidates":[{"url":"https://github.com/CaterMaoZi/CVE-2026-111497-POC","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Nodejs漏洞 CVE-2026-111497 POC","modified":"2026-10-26T04:30:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/CaterMaoZi/CVE-2026-111497-POC"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T04:30:42Z","url":"https://github.com/CaterMaoZi/CVE-2026-111497-POC"}],"tags":[]},{"url":"https://github.com/dimasma0305/CVE-2026-111497-POC","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness","modified":"2026-10-26T07:18:09Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/dimasma0305/CVE-2026-111497-POC"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T07:18:09Z","url":"https://github.com/dimasma0305/CVE-2026-111497-POC"}],"tags":[]},{"url":"https://github.com/Sami-AlEsh/nodejs-security-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Agent skill + zero-dependency script: check a Node.js project against the Oct 2026 Node.js security release (Brotli RCE CVE-2026-111497 and 9 more) and bump version pins to the patched release","modified":"2026-10-22T08:34:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Sami-AlEsh/nodejs-security-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-22T08:34:18Z","url":"https://github.com/Sami-AlEsh/nodejs-security-check"}],"tags":[]},{"url":"https://github.com/hypnguyen1209/CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Node.js Brotli Decoder OOB Write to RCE","modified":"2026-10-25T05:23:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/hypnguyen1209/CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T05:23:41Z","url":"https://github.com/hypnguyen1209/CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/AdapptOnAzure/cve-2026-111497-mitigation","source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T18:00:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/AdapptOnAzure/cve-2026-111497-mitigation"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T18:00:26Z","url":"https://github.com/AdapptOnAzure/cve-2026-111497-mitigation"}],"tags":[]},{"url":"https://github.com/TahuCryptsi/node-brotli-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Local probe for CVE-2026-111497 (Node.js Brotli decoder OOB write). Fixed in 22.23.4/24.22.1/26.12.1; EOL lines unpatched forever. Single file, zero deps.","modified":"2026-10-22T12:46:25Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/TahuCryptsi/node-brotli-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-22T12:46:25Z","url":"https://github.com/TahuCryptsi/node-brotli-check"}],"tags":[]},{"url":"https://github.com/incu-tech/october-cyber-family","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Security Ways for AI coding agents. First member audits Node.js repos for the Oct 21, 2026 security release (CVE-2026-111497 Brotli RCE) and opens a patch PR only if affected.","modified":"2026-10-22T16:40:43Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/incu-tech/october-cyber-family"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-22T16:40:43Z","url":"https://github.com/incu-tech/october-cyber-family"}],"tags":[]},{"url":"https://github.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497: Node.js Brotli decoder OOB write — analysis, PoC, Docker lab","modified":"2026-10-25T12:03:00Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T12:03:00Z","url":"https://github.com/TheFool-TAROT/CVE-2026-111497-brotli-pwn"}],"tags":[]},{"url":"https://github.com/ikow/brotli2crash","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497 — Node.js Brotli Decoder OOB Write: Deep Analysis & Structural Unreachability Proof. MLEN_MAX = BLOCK_SIZE_CAP = 2^24 makes RCE structurally unreachable.","modified":"2026-10-23T17:59:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/ikow/brotli2crash"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T17:59:55Z","url":"https://github.com/ikow/brotli2crash"}],"tags":[]},{"url":"https://github.com/Charlie-Netdevops/node-hostcheck","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"   Read-only Node.js check for the Oct 2026 security release (CVE-2026-111497 Brotli RCE + 9). Finds every install (nvm, fnm, volta, system), what each running process actually uses, restarts needed, and eMudhra CA issues.","modified":"2026-10-23T00:49:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Charlie-Netdevops/node-hostcheck"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T00:49:26Z","url":"https://github.com/Charlie-Netdevops/node-hostcheck"}],"tags":[]},{"url":"https://github.com/datmt/vulcheck","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Check and fix hosts, Docker containers and k8s pods: leaked eMudhra CA trust, and Brotli decoder CVE-2026-111497 scanner","modified":"2026-10-26T03:06:32Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/datmt/vulcheck"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T03:06:32Z","url":"https://github.com/datmt/vulcheck"}],"tags":[]},{"url":"https://github.com/duytien241/nodejs-CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T03:01:21Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/duytien241/nodejs-CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T03:01:21Z","url":"https://github.com/duytien241/nodejs-CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/shivrajem/node2shell-detect","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows","modified":"2026-10-24T10:26:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/shivrajem/node2shell-detect"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T10:26:19Z","url":"https://github.com/shivrajem/node2shell-detect"}],"tags":[]},{"url":"https://github.com/TahuCryptsi/brotli-distro-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Audit Linux hosts for CVE-2026-111497 vulnerable brotli (1.0.3-1.2.0, CVSS 4.0 9.2). dpkg/apk/rpm/Node aware. Verified across live containers.","modified":"2026-10-23T09:52:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/TahuCryptsi/brotli-distro-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T09:52:19Z","url":"https://github.com/TahuCryptsi/brotli-distro-check"}],"tags":[]},{"url":"https://github.com/ZeroHackOrg/node2shell-poc","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework","modified":"2026-10-24T05:11:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/ZeroHackOrg/node2shell-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T05:11:26Z","url":"https://github.com/ZeroHackOrg/node2shell-poc"}],"tags":[]},{"url":"https://github.com/Arkango/CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder OOB heap write. Independent research: exploit code, Docker labs, Express RCE gap analysis.","modified":"2026-10-26T07:17:00Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Arkango/CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T07:17:00Z","url":"https://github.com/Arkango/CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup","source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T20:05:13Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T20:05:13Z","url":"https://github.com/w116tjb/CVE-2026-111497_nodejs_hash_lookup"}],"tags":[]},{"url":"https://github.com/AmanSin001/node-brotli-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Check a Node.js runtime for the CVE-2026-111497 Brotli decoder fix and find where a project decodes outside Brotli data. No dependencies.","modified":"2026-10-23T15:52:58Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/AmanSin001/node-brotli-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T15:52:58Z","url":"https://github.com/AmanSin001/node-brotli-check"}],"tags":[]},{"url":"https://github.com/trailofbits/brotli-checker","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497.","modified":"2026-10-26T06:03:13Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/trailofbits/brotli-checker"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T06:03:13Z","url":"https://github.com/trailofbits/brotli-checker"}],"tags":[]},{"url":"https://github.com/CompleTetech-Security/node2shell-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. Python 3.10+, no dependencies, no exploit payloads.","modified":"2026-10-26T05:05:58Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/CompleTetech-Security/node2shell-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T05:05:58Z","url":"https://github.com/CompleTetech-Security/node2shell-check"}],"tags":[]},{"url":"https://github.com/Ghost-Bx1/Node2Shell-CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497 - Node.js Brotli OOB Write Pre-Auth RCE (Node2Shell) | CVSS 4.0: 9.2 | PoC + Full Exploit | By Gh0st-Bx1","modified":"2026-10-24T16:52:39Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Ghost-Bx1/Node2Shell-CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T16:52:39Z","url":"https://github.com/Ghost-Bx1/Node2Shell-CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/fuzheado/n2s-buildpack-probe","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Throwaway probe: does Toolforge Build Service honour engines.node (CVE-2026-111497)","modified":"2026-10-23T21:20:52Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/fuzheado/n2s-buildpack-probe"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-23T21:20:52Z","url":"https://github.com/fuzheado/n2s-buildpack-probe"}],"tags":[]},{"url":"https://github.com/ks-labs/brotli-patch","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Node.js (14 e 20, em fim de vida) com o decoder Brotli corrigido: CVE-2026-111497 (Node2Shell). Não oficial.","modified":"2026-10-26T01:57:46Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/ks-labs/brotli-patch"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T01:57:46Z","url":"https://github.com/ks-labs/brotli-patch"}],"tags":[]},{"url":"https://github.com/Blackman99/lotstamp","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Reads the Brotli decoder inside every Node, Bun, Electron app and AI coding tool on your machine: which still carry CVE-2026-111497. Executes nothing.","modified":"2026-10-26T02:14:45Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Blackman99/lotstamp"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T02:14:45Z","url":"https://github.com/Blackman99/lotstamp"}],"tags":[]},{"url":"https://github.com/mahumadad/CVE-2026-111497-assessment","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Defensive assessment toolkit for CVE-2026-111497 (Brotli OOB write): ecosystem scanner, Python outbound PoC, canary server, CDN amplification analysis, framework defense matrix","modified":"2026-10-24T03:17:35Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/mahumadad/CVE-2026-111497-assessment"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T03:17:35Z","url":"https://github.com/mahumadad/CVE-2026-111497-assessment"}],"tags":[]},{"url":"https://github.com/googlesky/CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"PoC, Docker lab, and technical report for CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder invalid block-switch OOB write; validated errno differential and weaponized remote DoS, RCE analysis included.","modified":"2026-10-24T07:11:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/googlesky/CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T07:11:31Z","url":"https://github.com/googlesky/CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/lesterlam/node2shell","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Independent reproduction of the Brotli decoder out-of-bounds write behind CVE-2026-111497 (Node2Shell): payload built from first principles, A/B against the patched release, and a measured ceiling that rules out the advertised RCE path.","modified":"2026-10-24T09:48:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/lesterlam/node2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T09:48:14Z","url":"https://github.com/lesterlam/node2shell"}],"tags":[]},{"url":"https://github.com/Secragon/node2shell-radar","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Find Node.js websites and see which ones need attention. Desktop Node2Shell Scanner for CVE-2026-111497.","modified":"2026-10-25T11:10:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Secragon/node2shell-radar"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T11:10:40Z","url":"https://github.com/Secragon/node2shell-radar"}],"tags":[]},{"url":"https://github.com/pt-act/node2shell-cve-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Node2Shell / HTTP2Shell (CVE-2026-111497) exposure-audit kit — read-only scanner + agent prompt pack. Portable: macOS bash 3.2 + Linux. Mutation-tested regression suite, CI on 3 platforms.","modified":"2026-10-26T00:23:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/pt-act/node2shell-cve-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T00:23:06Z","url":"https://github.com/pt-act/node2shell-cve-2026-111497"}],"tags":[]},{"url":"https://github.com/s1ko/poc-cve-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497 (Node2Shell): deteccion del decoder Brotli vulnerable en Python y Node por el codigo de error real del decoder, con laboratorio HTTP local","modified":"2026-10-24T15:19:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/s1ko/poc-cve-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T15:19:47Z","url":"https://github.com/s1ko/poc-cve-2026-111497"}],"tags":[]},{"url":"https://github.com/tc4dy/CVE-2026-111497-Toolkit","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26.x. 2 tools: Full Exploit (patch detection, remote DoS, Brotli bomb, lab RCE), Blue Team Checker (errno differential, version fingerprint, WAF detection, reporting) Only Use Ethically Only <3","modified":"2026-10-24T15:56:21Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/tc4dy/CVE-2026-111497-Toolkit"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T15:56:21Z","url":"https://github.com/tc4dy/CVE-2026-111497-Toolkit"}],"tags":[]},{"url":"https://github.com/mnk-works/cve-2026-111497-rce-checker","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Lab-only exact-profile RCE/DoS validator for CVE-2026-111497; refuses non-loopback targets","modified":"2026-10-24T22:06:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/mnk-works/cve-2026-111497-rce-checker"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-24T22:06:29Z","url":"https://github.com/mnk-works/cve-2026-111497-rce-checker"}],"tags":[]},{"url":"https://github.com/syrex1013/CVE-2026-111497-node2shell","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)","modified":"2026-10-26T07:49:30Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/syrex1013/CVE-2026-111497-node2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T07:49:30Z","url":"https://github.com/syrex1013/CVE-2026-111497-node2shell"}],"tags":[]},{"url":"https://github.com/yavuzsemih/brotli-secfix","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.","modified":"2026-10-25T00:26:25Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/yavuzsemih/brotli-secfix"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T00:26:25Z","url":"https://github.com/yavuzsemih/brotli-secfix"}],"tags":[]},{"url":"https://github.com/GlobularOne/HTTP2Shell-PoC","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"PoC for CVE-2026-111497 (HTTP2Shell)","modified":"2026-10-25T07:19:23Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/GlobularOne/HTTP2Shell-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T07:19:23Z","url":"https://github.com/GlobularOne/HTTP2Shell-PoC"}],"tags":[]},{"url":"https://github.com/assetnote/node2shell-scanner","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"High fidelity detection mechanism for node2shell (CVE-2026-111497)","modified":"2026-10-26T07:43:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/assetnote/node2shell-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T07:43:19Z","url":"https://github.com/assetnote/node2shell-scanner"}],"tags":[]},{"url":"https://github.com/tani2shell/node2shell-lab","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.","modified":"2026-10-26T01:15:46Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/tani2shell/node2shell-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T01:15:46Z","url":"https://github.com/tani2shell/node2shell-lab"}],"tags":[]},{"url":"https://github.com/lushinshang/cve-2026-111497-http2shell-guide","source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T11:35:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/lushinshang/cve-2026-111497-http2shell-guide"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T11:35:19Z","url":"https://github.com/lushinshang/cve-2026-111497-http2shell-guide"}],"tags":[]},{"url":"https://github.com/apaonum/brotli-cve-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes","modified":"2026-10-25T13:19:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/apaonum/brotli-cve-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T13:19:36Z","url":"https://github.com/apaonum/brotli-cve-check"}],"tags":[]},{"url":"https://github.com/SYM01/cve-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T02:02:48Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/SYM01/cve-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T02:02:48Z","url":"https://github.com/SYM01/cve-2026-111497"}],"tags":[]},{"url":"https://github.com/tikarammardi/CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T17:27:38Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/tikarammardi/CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T17:27:38Z","url":"https://github.com/tikarammardi/CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/fbuff-tools/http2shell-checker","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.","modified":"2026-10-25T17:59:22Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/fbuff-tools/http2shell-checker"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T17:59:22Z","url":"https://github.com/fbuff-tools/http2shell-checker"}],"tags":[]},{"url":"https://github.com/Hika-sec/http2shell-CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.","modified":"2026-10-25T20:00:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/Hika-sec/http2shell-CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T20:00:18Z","url":"https://github.com/Hika-sec/http2shell-CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/emirwtz/CVE-2026-111497","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.","modified":"2026-10-25T18:43:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/emirwtz/CVE-2026-111497"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-25T18:43:51Z","url":"https://github.com/emirwtz/CVE-2026-111497"}],"tags":[]},{"url":"https://github.com/CompleTetech-Security/http2shell-check","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.","modified":"2026-10-26T05:02:56Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/CompleTetech-Security/http2shell-check"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T05:02:56Z","url":"https://github.com/CompleTetech-Security/http2shell-check"}],"tags":[]},{"url":"https://github.com/ionsec/node2shell-detector","source":"poc-in-github","sourceId":"CVE-2026-111497","description":"node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.","modified":"2026-10-26T04:56:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-111497","url":"https://github.com/ionsec/node2shell-detector"},{"source":"poc-in-github","sourceId":"CVE-2026-111497","modified":"2026-10-26T04:56:50Z","url":"https://github.com/ionsec/node2shell-detector"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:brotli-0:1.2.1-0.1.hum1@aarch64","product":"brotli-0:1.2.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/brotli@1.2.1-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:brotli-0:1.2.1-0.1.hum1@s390x","product":"brotli-0:1.2.1-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/brotli@1.2.1-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:brotli-0:1.2.1-0.1.hum1@src","product":"brotli-0:1.2.1-0.1.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/brotli@1.2.1-0.1.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:brotli-devel-0:1.2.1-0.1.hum1@aarch64","product":"brotli-devel-0:1.2.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/brotli-devel@1.2.1-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:brotli-devel-0:1.2.1-0.1.hum1@s390x","product":"brotli-devel-0:1.2.1-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/brotli-devel@1.2.1-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:brotli-devel-0:1.2.1-0.1.hum1@x86_64","product":"brotli-devel-0:1.2.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/brotli-devel@1.2.1-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:libbrotli-0:1.2.1-0.1.hum1@aarch64","product":"libbrotli-0:1.2.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/libbrotli@1.2.1-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:libbrotli-0:1.2.1-0.1.hum1@s390x","product":"libbrotli-0:1.2.1-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/libbrotli@1.2.1-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:python3-brotli-0:1.2.1-0.1.hum1@aarch64","product":"python3-brotli-0:1.2.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/python3-brotli@1.2.1-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:python3-brotli-0:1.2.1-0.1.hum1@s390x","product":"python3-brotli-0:1.2.1-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/python3-brotli@1.2.1-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"Red Hat Hardened Images:python3-brotli-0:1.2.1-0.1.hum1@x86_64","product":"python3-brotli-0:1.2.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:87420"},{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."}],"purl":"pkg:rpm/redhat/python3-brotli@1.2.1-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"exploit_intelligence:exploit-intelligence/vulnerability-analysis-rhel9","product":"exploit-intelligence/vulnerability-analysis-rhel9 as a component of Exploit Intelligence","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vulnerability-analysis-rhel9?repository_url=registry.redhat.io/exploit-intelligence/vulnerability-analysis-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_ansible_automation_platform_2:python3.11-brotli.src","product":"python3.11-brotli.src as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python3.11-brotli?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_10:firefox.src","product":"firefox.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/firefox?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_8:brotli","product":"brotli as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/brotli","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_8:nodejs-libs::nodejs:24","product":"nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_8:npm::nodejs:24","product":"npm (nodejs:24) as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/npm?rpmmod=nodejs:24","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_9:brotli-devel","product":"brotli-devel as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/brotli-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_9:nodejs-docs::nodejs:26","product":"nodejs-docs (nodejs:26) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:26","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_9:nodejs::nodejs:26","product":"nodejs (nodejs:26) as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/nodejs?rpmmod=nodejs:26","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_jboss_core_services:jbcs-httpd24-brotli.src","product":"jbcs-httpd24-brotli.src as a component of Red Hat JBoss Core Services","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/jbcs-httpd24-brotli?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_update_infrastructure_4_for_cloud_providers:python-brotli.src","product":"python-brotli.src as a component of Red Hat Update Infrastructure 4 for Cloud Providers","status":"known_affected","remediations":[{"category":"workaround","details":"See the security bulletin for a detailed mitigation procedure."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python-brotli?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"confidential_compute_attestation:build-of-trustee/trustee-rhel9","product":"build-of-trustee/trustee-rhel9 as a component of Confidential Compute Attestation","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/trustee-rhel9?repository_url=registry.redhat.io/build-of-trustee/trustee-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_10:goose.src","product":"goose.src as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/goose?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_10:nodejs-npm","product":"nodejs-npm as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs-npm","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_10:nodejs24-npm","product":"nodejs24-npm as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs24-npm","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_8:mozjs60.src","product":"mozjs60.src as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/mozjs60?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_8:nodejs-nodemon::nodejs:22","product":"nodejs-nodemon (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_8:npm::nodejs:22","product":"npm (nodejs:22) as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/npm?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_9:nodejs-docs::nodejs:22","product":"nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rust.src","product":"rust.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/rust?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]},{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json","productId":"red_hat_trusted_profile_analyzer:rhtpa/rhtpa-trustification-service-rhel9","product":"rhtpa/rhtpa-trustification-service-rhel9 as a component of Red Hat Trusted Profile Analyzer","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/rhtpa-trustification-service-rhel9?repository_url=registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-111497","modified":"2026-10-26T11:02:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111497.json"}]}],"vendorCoverage":{"total":146,"shown":32,"omitted":114,"source":"redhat"}}