Google's Brotli decoder picked up a critical out-of-bounds write this week. Because the same code is compiled into Node.js, Python, Bun, Envoy and Istio, roughly everything is in scope. EPSS flagged it two days before CISA did. Further down, a CVSS 10 page builder bug that is under active attack and that almost no scoring system will surface for you.
Brotli CVE-2026-111497: one bug, four names
What it is: an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0. If an application decompresses Brotli data an attacker controls, the attacker can corrupt memory, which can lead to a crash, memory disclosure or code execution. Google rates it CVSS 9.2.
What it's called: depending on who you read, this is Node2Shell, Broccoli2Shell (Wiz), HTTP2Shell (Tanium) or Brotli2Shell (Tenable). If you're searching vendor advisories to see whether you're affected, search for the CVE ID. Searching for one nickname will miss advisories that use another.
EPSS moved two days before KEV
- Oct 21: Node.js publishes fixes.
- Oct 22: CVE published.
- Oct 24: EPSS 0.7%.
- Oct 25: EPSS jumps to 33%.
- Oct 27: EPSS 55%. CISA adds it to KEV, citing evidence of active exploitation. Federal civilian agencies have until November 10 to remediate.
- Oct 28: EPSS 88%.
If your patching queue only reacts to KEV, you got this two days later than teams watching EPSS.
It's not just Node.js
The same decoder is compiled into a lot of software. Fixed versions:
- Brotli library: 1.0.10, 1.1.1 or 1.2.1
- Node.js: 22.23.4, 24.22.1 or 26.12.1. Treat end-of-life lines as affected and move off them.
- Python:
Brotli1.2.1,brotlicffi1.2.1.0 - Bun: 1.4.4
- Envoy: 1.36.12, 1.37.8, 1.38.6, 1.39.3 or 1.40.0
- Istio: 1.29.9, 1.30.6 or 1.31.2. The 1.29 line is end of life, so treat that one as a move to a supported branch rather than a patch.
- Go (
andybalholm/brotli): v1.2.7 - .NET, brotli4j and OS packages: check your vendor's advisory
One qualifier before you panic about your service mesh. Envoy and Istio only reach the vulnerable code when Brotli decompression is explicitly turned on, usually through an EnvoyFilter. If you never enabled it, the decoder is present but never runs. Check your filter chains before you schedule an emergency mesh upgrade.
Two things make the rest of this hard to inventory:
- Decompression can happen automatically. Many HTTP clients and frameworks decompress Brotli without being asked, so an application can be exposed even though its code never mentions Brotli.
- Bundled copies don't get OS updates. Statically linked and vendored copies stay vulnerable after you patch the system package. Container images need a rebuild, not just a host update.
Quick checks:
- Node.js:
node -vand compare against the fixed versions above - Python:
pip show brotli brotlicffi - Go:
go list -m all | grep andybalholm/brotli - Debian/Ubuntu:
dpkg -l | grep -i brotli - RHEL/Fedora:
rpm -qa | grep -i brotli
Can't patch today? Disable Brotli decompression, or reject Brotli-encoded request bodies at your proxy before they reach a vulnerable service. That reduces exposure. It doesn't replace the patch.
The GitHub flood
Rapid Risk Radar tracks 52 GitHub repositories for this CVE, all created in about a week. Sorted by repo name, 24 are scanners and "am I vulnerable?" checkers, including ones from Trail of Bits and Assetnote. Only 6 claim to be exploits, and 3 are home-made patched builds. As with PHP2Shell last week, "public PoC available" mostly means "public scanners available". Don't run unreviewed "PoC" code against production.
Full source list, exploitation status and EPSS history: CVE-2026-111497 on Rapid Risk Radar
YOOtheme Pro CVE-2026-102785: CVSS 10, exploited, and EPSS says 0.8%
Brotli is the week's big story and everyone is covering it. This one is the opposite, which makes it the better illustration of why scores alone don't work.
The facts. Unauthenticated remote code execution through YOOtheme Pro's public image handler, affecting 5.0.0 through 5.0.52 in both the WordPress and Joomla editions. 5.0.53 fixes it and was released on October 21. CVSS 10. Palo Alto Networks Unit 42 confirmed in-the-wild attacks on October 26, and three site-maintenance firms have reported compromised sites, the first on the morning of October 21, hours before the fix shipped. Both mySites.guru and db8 found webshells dropped into public image folders.
The scoring gap. EPSS is 0.8%. It isn't on CISA KEV, which we checked the morning this went out. BleepingComputer and The Hacker News still have nothing. Filter your queue on EPSS or KEV this week and a CVSS 10 unauthenticated RCE under confirmed attack sorts below hundreds of CVEs nobody is touching. That is the gap we built Rapid Risk Radar to close.
If you run it. Update every YOOtheme Pro 5 site to 5.0.53 or later. There is no partial mitigation, and Joomla's built-in offline mode is not enough. Treat any site that was online on October 21–22 as possibly compromised, because updating closes the hole but removes nothing an attacker left behind. Look for PHP files in image, cache, media or upload folders, files changed since October 21 that nobody on your side touched, and administrator accounts you didn't create. If you're an agency running many client sites, sweep for it today.
Track it: CVE-2026-102785 on Rapid Risk Radar
Also on our radar
- PHP2Shell is now on CISA KEV. CVE-2026-109618 and CVE-2026-109619 were added on October 26. EPSS for both now sits at 99.99%, up from about 5% a week ago. If you run PHP and haven't patched to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, it's overdue. Restart your PHP workers after patching; the fix doesn't apply until you do.
- The same login bypass turned up in two products.
- Laravel CVE-2026-114509 and LibreNMS CVE-2026-86426 share a bug class. Send a number or an array where the API expects a string token, and MySQL's type coercion can match it to a real user.
- Fixes: Laravel 12.68.0 and 13.29.0, LibreNMS 26.8.0. Laravel 10 and 11 reportedly have no fix.
- Public exploit code exists for Laravel. Our sources show exploitation attempts against both, though neither is on CISA KEV yet.
Rapid Risk Radar combines CVSS, EPSS, KEV, exploitation reports and public chatter for every CVE, so bugs like YOOtheme Pro show up before the headlines do. Create a free account to search, filter and get alerted on what matters to your stack.