Brotli Decoder RCE: Why CVE-2026-111497 Became a CISA Emergency Beyond Node.js

A Brotli decoder RCE, tracked as CVE-2026-111497, landed in CISA's Known Exploited Vulnerabilities catalog on October 27, 2026, the same day as an unrelated Adobe Commerce file-upload bug, CVE-2026-48356. On paper the two CVEs share nothing. In live attacks, they're chained: the Magento bug gets attackers onto a server, and the Brotli bug is what they use to run code once inside.

Jump to which runtimes are exposed even if you've never heard of Magento if the Brotli half is what brought you here.

The Magento Half: PolyShell Has Been Running Since July 2025

Sansec's original research traces a single campaign back to July 2025, well before either CVE in this story existed. Attackers inject a JavaScript loader into a store's cms_block database table, which rides in on legitimate storefront content instead of a theme file most scanners check.

When a real visitor loads the page, their browser calls out to an attacker-controlled domain. That domain fingerprints the request, checking navigator.webdriver, Selenium globals, and ChromeDriver's cdc_ properties, before deciding whether to serve a payload or stay silent. Automated scanners get nothing; real shoppers might get something.

The campaign has rotated through five domains since July 2025. The latest, deepveindrilling.com, was registered October 6, 2026, and was live in CMS blocks on 83 stores by the next evening. By October 24, Sansec had re-crawled 71 of those stores and found every one running a rewritten loader.

According to gbhackers.com's writeup of the same Sansec data, one fully-patched Magento 2.4.7-p10 store received the new loader anyway, because an attacker had already planted a rogue administrator account and a GSocket backdoor during an earlier compromise. Patching the current CVE doesn't evict an attacker who already has a foothold.

CISA's KEV entry for CVE-2026-48356 confirms the mechanism: an unrestricted file upload that lets an attacker gain elevated access over a victim's session. Sansec and gbhackers both tie active exploitation back to March 2026's "PolyShell mass attack," where 471 stores were hit within one hour of the first webshell upload.

The Brotli Half: The Door Attackers Walk Through Once They're In

Here's where the story stops being Magento-specific. The Hacker News reported that ELLIO, analyzing live attack traffic, confirmed the payload hitting compromised stores was "a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0," matching public exploit tooling for CVE-2026-111497 exactly.

Once PolyShell gets attackers a foothold on a Magento store, they aren't writing a custom Magento exploit. They're reaching for a generic Brotli decoder bug that happens to sit in the Node.js backend those stores often run alongside PHP.

CVE-2026-111497 is an out-of-bounds write. Per Rapid7's advisory, the decoder mishandles an invalid Brotli block switch, treating it as a need for more input instead of flagging a permanent format error. That mishandling lets crafted compressed data corrupt memory past a buffer's end. Node.js bundles Brotli as a dependency, which is why Node.js 22.x, 24.x, and 26.x releases before the October 2026 patches are all affected.

Which Runtimes Are Exposed Even If You've Never Heard of Magento

Most coverage framed this as "a Node.js bug," which undersells it. A second Hacker News report names the vulnerable Brotli library itself, not just Node's bundled copy. Every runtime that vendors or links it inherits the same flaw:

Component	Affected versions	Fixed in	Exposed when
Google Brotli (C library)	1.0.3 to 1.2.0	1.0.10, 1.1.1, 1.2.1	Code decodes untrusted Brotli data
Node.js	22.x, 24.x, 26.x before the fix	22.23.4, 24.22.1, 26.12.1	fetch() of a br response, or Express/body-parser br bodies
Bun	1.4.3 and earlier	1.4.4	Same decode paths as Node.js
.NET	8.0, 9.0, 10.0 before the fix	8.0.33, 9.0.22, 10.0.14	Only if Brotli is enabled in ASP.NET Core or HttpClient decompression
Envoy / Istio	Versions before Oct 2026 patches	1.40.0 (Envoy), 1.31.2 (Istio)	Only if the Brotli decompressor is explicitly configured
Python Brotli / brotlicffi	1.2.0 and earlier	1.2.1 / 1.2.1.0	Installed, and an HTTP client decodes br

The flaw was reported by OpenAI's own Codex Security team. Their framing, quoted by The Hacker News, is worth sitting with: an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input, such as curl --compressed, could be taken over by a malicious server. It runs in both directions.

Imperva has demonstrated actual code execution on an unpatched Node.js build. The same hasn't been publicly shown for Bun, Python, Envoy, or .NET yet, but the underlying memory bug is identical code, not a different implementation per language, so treat the gap as untested rather than safe.

Why Two Unrelated CVEs Converging Is the Actual Lesson

A file-upload bug in a PHP e-commerce platform and a memory-corruption bug in a Google-maintained compression library don't belong in the same threat model on paper. They ended up in the same CISA KEV batch because an attacker doesn't respect your architecture diagram's module boundaries.

PolyShell got attackers a place to run code. Node2Shell is what they reached for once inside, because enough Magento deployments run a Node.js-based layer, SSR frontends, build tooling, API middleware, that the Brotli bug was simply available. If your inventory tracks "patched Magento: yes or no" as a single checkbox, you'll miss that the Node.js process next to your Magento install is a second, independently exploitable surface the same attacker is already using.

Our verdict: patch both CVEs this week regardless of which one looks more relevant to your stack, and audit for prior compromise before trusting either patch alone. The catch with CVE-2026-48356 specifically is that patching it doesn't remove an attacker who already planted a backdoor during an earlier, unpatched window, as Sansec's fully-patched-but-still-compromised store shows.

What to Actually Do This Week

1. Patch CVE-2026-48356 (Adobe's APSB26-73) on every Adobe Commerce and Magento instance, including ones you believe were already clean.
2. Audit for prior compromise before trusting the patch. Check cms_block entries for injected script tags, review admin accounts for ones you didn't create, and scan upload directories for files that aren't images despite their extension.
3. Patch the Brotli decoder everywhere it's vendored, not just in package.json. npm update doesn't touch it; the decoder ships inside the Node.js and Bun binaries, Python wheels, and Envoy/.NET runtimes. Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1; Bun to 1.4.4; Python Brotli to 1.2.1; brotlicffi to 1.2.1.0.
4. Don't assume "we don't run Magento" clears you. Any service that fetches a remote URL and auto-decodes a br-encoded response, which most HTTP clients do by default, is exposed to the Brotli half independent of Magento.
5. Don't stop at node --version in one terminal. Verify the runtime actually serving production traffic, since a patched dev environment next to an unpatched container image is the same kind of gap Sansec's compromised-despite-patches Magento store illustrates at a different layer.

FAQ

Is CVE-2026-111497 just a Node.js problem?
No. CVE-2026-111497 is a flaw in the underlying Google Brotli decoder library. It affects every runtime that vendors or links the same library, including Node.js, Bun, .NET when Brotli decompression is enabled, Envoy, Istio, and Python's Brotli and brotlicffi packages.

How are the Adobe Commerce PolyShell bug and the Brotli bug connected?
They're two unrelated CVEs that attackers are chaining together in live attacks. CVE-2026-48356, PolyShell, is a file-upload flaw that gets attackers a foothold on a Magento store. Once inside, ELLIO's traffic analysis confirmed attackers deploying a Node2Shell exploit for CVE-2026-111497 against the store's Node.js backend.

How do I fix the Brotli decoder vulnerability?
Upgrade the runtime, not just the package lockfile, because most affected software bundles its own copy of the decoder. Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1; Bun to 1.4.4; Python Brotli to 1.2.1; and brotlicffi to 1.2.1.0, then rebuild and redeploy affected images rather than just reinstalling dependencies.

What We Checked Before Publishing

We pulled CISA's own KEV catalog entry, Sansec's original research post, Rapid7's technical advisory for CVE-2026-111497, two separate Hacker News reports, and gbhackers.com's independent writeup of the same Sansec data to confirm the store counts and timeline matched across sources. The ELLIO and OpenAI Codex Security team attributions both came from the same Hacker News reporting and weren't independently re-verified against ELLIO's or OpenAI's own channels, a limitation worth naming rather than smoothing over.

I'm Rohit, founder of Krova Cloud: disposable, per-minute-billed VMs with no lingering state between workloads, so a Node.js process you spin up to test a patch today can't quietly become the five-month-old backdoor a scanner misses later. More debugging stories at debugly.dev.

Structured Data

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "headline": "Brotli Decoder RCE: Why CVE-2026-111497 Became a CISA Emergency Beyond Node.js",
      "datePublished": "2026-10-28",
      "dateModified": "2026-10-28",
      "author": {
        "@type": "Person",
        "name": "Rohit"
      },
      "about": ["CVE-2026-111497", "Brotli decoder vulnerability", "CVE-2026-48356 PolyShell", "CISA KEV catalog", "Magento security"]
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "Is CVE-2026-111497 just a Node.js problem?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "No. CVE-2026-111497 is a flaw in the underlying Google Brotli decoder library. It affects every runtime that vendors or links the same library, including Node.js, Bun, .NET when Brotli decompression is enabled, Envoy, Istio, and Python's Brotli and brotlicffi packages."
          }
        },
        {
          "@type": "Question",
          "name": "How are the Adobe Commerce PolyShell bug and the Brotli bug connected?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "They're two unrelated CVEs that attackers are chaining together in live attacks. CVE-2026-48356, PolyShell, is a file-upload flaw that gets attackers a foothold on a Magento store. Once inside, ELLIO's traffic analysis confirmed attackers deploying a Node2Shell exploit for CVE-2026-111497 against the store's Node.js backend."
          }
        },
        {
          "@type": "Question",
          "name": "How do I fix the Brotli decoder vulnerability?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Upgrade the runtime, not just the package lockfile, because most affected software bundles its own copy of the decoder. Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1; Bun to 1.4.4; Python Brotli to 1.2.1; and brotlicffi to 1.2.1.0, then rebuild and redeploy affected images."
          }
        }
      ]
    }
  ]
}