CVE-2026-111497: 
脆弱性分析と緩和策

CVE-2026-111497 is a buffer overflow (out-of-bounds write) vulnerability in the Google Brotli decoder (c/dec/decode.c) affecting versions 1.0.3 through 1.2.0 on all platforms. Discovered by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer, it was disclosed on October 21–22, 2026 and is widely tracked under the alias Node2Shell (also called HTTP2Shell and Broccoli2Shell). The flaw affects Google Brotli directly and propagates to all software bundling it, including Node.js (< 22.23.4, < 24.22.1, < 26.12.1), Microsoft .NET (8.x < 8.0.33, 9.x < 9.0.22, 10.x < 10.0.14), Python PyPI brotli/brotlicffi packages, Envoy, Istio, ClickHouse, Apache Arrow, DuckDB, Bun, p7zip, PAN-OS, and many others. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (Github Advisory, Node.js Advisory).

The root cause is an unchecked return value (CWE-252) combined with an out-of-bounds write (CWE-787) in the Brotli streaming decoder's block-switch handling. When the decoder encounters an invalid block-switch structure in a compressed stream, it incorrectly reports the condition as a temporary need for more input rather than a permanent format error. As a result, the decoder continues appending incoming bytes to an internal 8-byte buffer beyond its boundary, corrupting adjacent decoder state memory. In Node.js, the vulnerable code path is reachable via node:zlib APIs (zlib.brotliDecompress, createBrotliDecompress) and implicitly through fetch() when a server responds with Content-Encoding: br. No authentication or user interaction is required; an attacker only needs to supply a crafted Brotli-compressed stream to any endpoint that decompresses it (Node.js Advisory, Github Advisory).

Successful exploitation can result in corruption of adjacent decoder state memory, disclosure of sensitive process memory contents, denial of service via crash or infinite CPU loop, or remote code execution within the context of the application processing the compressed data. Because the Brotli library is bundled in many widely deployed runtimes and frameworks — including Node.js, .NET, Python packages, Envoy, Istio, PAN-OS, ClickHouse, and others — the blast radius is exceptionally broad, spanning web servers, API gateways, service meshes, data analytics platforms, and network security appliances. Imperva researchers independently validated that the flaw can lead to code execution on official Node.js builds, and the PingBack malware family has been reported as weaponizing this vulnerability (Github Advisory, Palo Alto Networks).

CVE-2026-111497 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026, with a federal patch deadline of October 29, 2026 (CISA KEV, Security Affairs). Multiple public proof-of-concept repositories exist on GitHub demonstrating denial-of-service and memory corruption; at least one PoC (TheFool-TAROT/CVE-2026-111497-brotli-pwn) includes a local RCE demonstration requiring deterministic memory layout, though no self-contained remote RCE exploit has been publicly confirmed. The EPSS score is approximately 32.8% (and the GitHub Advisory Database reports an 82.6th percentile EPSS), indicating high exploitation probability. Honeypots have logged active attack attempts, and Sophos, Fortinet (Node2Shell Outbreak Alert), and SecurityWeek have reported in-the-wild exploitation. The PingBack malware family has been linked to weaponization of this vulnerability (Feedly, Sophos).

1. Reconnaissance: Identify internet-facing services that accept Brotli-compressed HTTP request bodies or decompress Brotli-encoded responses — e.g., Node.js APIs using zlib.brotliDecompress or fetch(), .NET applications, Python services with the brotli PyPI package, or Envoy/Istio proxies. Use Shodan, Censys, or active probing to fingerprint vulnerable versions.
2. Craft malicious Brotli stream: Construct a Brotli-compressed stream with an invalid block-switch structure — specifically, setting NBLTYPES fields to values (e.g., 0 or 1) that trigger the decoder to misclassify a permanent format error as a temporary need for more input. Public fuzzing harnesses (e.g., ikow/brotli2crash, CaterMaoZi/CVE-2026-111497-POC) demonstrate payload generation techniques.
3. Deliver payload: Send the crafted stream to the target endpoint via HTTP POST with Content-Encoding: br header, or embed it in any channel where the application decompresses Brotli data (e.g., WebSocket frames, file uploads, API request bodies).
4. Trigger out-of-bounds write: The vulnerable decoder appends bytes past the end of its 8-byte internal buffer, corrupting adjacent memory. Depending on heap layout, this may cause an immediate crash (DoS), leak memory contents, or overwrite function pointers or other control-flow data.
5. Achieve code execution (advanced): With knowledge of the target's memory layout (e.g., via a separate information disclosure or deterministic heap grooming), craft the overflow to overwrite a code pointer and redirect execution to attacker-controlled shellcode or a ROP chain. Imperva and Ellio.tech researchers demonstrated this on official Node.js Linux ARM64 builds (Node.js Advisory, Github Advisory).

• Network: Unusual HTTP POST requests with Content-Encoding: br headers containing malformed or minimal Brotli payloads (e.g., payloads < 100 bytes with invalid metablock headers); repeated requests to decompression endpoints from unexpected source IPs; outbound connections from Node.js or application processes to unknown external hosts following decompression activity.
• Logs: Application error logs showing BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH or similar decoder format errors (patched builds) vs. silent acceptance or generic errors (unpatched builds); Node.js crash logs (SIGSEGV, SIGABRT, or Windows access violation) originating from zlib.brotliDecompress or createBrotliDecompress call stacks; web server access logs with Content-Encoding: br on POST/PUT requests to API endpoints.
• File System: Unexpected files written by the application process (web shells, scripts) in web root or temp directories; new cron jobs or scheduled tasks created by the application service account; core dump files generated by the Node.js or .NET process.
• Process: Unusual child processes spawned by Node.js, .NET, or Python runtimes (e.g., /bin/sh, cmd.exe, curl, wget, python); abnormal CPU usage spikes in decompression worker threads (infinite loop condition); process crashes and automatic restarts of application services.
• Memory/Runtime: Detection of BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH absence in error responses (indicating unpatched decoder); heap corruption signals in application performance monitoring (APM) tools (Feedly, Sophos).

Primary remediation: Update the Brotli library to a patched version — 1.0.10, 1.1.1, or 1.2.1 — and update all dependent software:

• Node.js: Upgrade to 22.23.4, 24.22.1, or 26.12.1 (Node.js Advisory)
• Microsoft .NET: Apply the out-of-band security update (8.0.33, 9.0.22, 10.0.14) (Microsoft MSRC)
• Python: Upgrade brotli to ≥ 1.2.1 and brotlicffi to ≥ 1.2.1.0 (Github Advisory)
• PAN-OS: Upgrade to fixed hotfix versions per product line, or disable Brotli inspection via CLI (set system setting brotli-encoding disable) or Web UI (Palo Alto Networks)
• Envoy: Upgrade to ≥ 1.37.8, ≥ 1.38.6, or ≥ 1.39.3
• Istio: Upgrade to ≥ 1.29.9, ≥ 1.30.6, or ≥ 1.31.2

Workarounds (if immediate patching is not feasible): Deploy WAF rules to block or inspect requests with Content-Encoding: br (Cloudflare, Azure WAF, and AWS WAF released emergency rules); disable Brotli decompression at the reverse proxy or load balancer layer; use network segmentation to limit exposure of services that decompress Brotli data from untrusted sources.

The vulnerability generated exceptional industry attention, being dubbed "Black October" alongside concurrent PHP and GitLab vulnerabilities. OpenAI's Codex Security team was credited with discovering the flaw, and Imperva researchers independently demonstrated RCE on an official Node.js Linux ARM64 build, publishing the "Node2Shell" write-up. Cloudflare, Azure WAF, and AWS deployed emergency WAF rules within days of disclosure. Fortinet issued a Node2Shell Outbreak Alert. SANS ISC, BleepingComputer, The Hacker News, SecurityWeek, The Register, Forbes, and Ars Technica all covered the vulnerability extensively. Security researchers on Mastodon and Bluesky noted the unusually broad supply-chain impact — affecting not just Node.js but Python, .NET, Bun, Envoy, Istio, ClickHouse, and embedded firmware. Community discussion on Hacker News and Reddit highlighted the challenge of transitive dependency exposure (e.g., npm packages not directly importing zlib still being vulnerable). Vercel deployed emergency firewall rules, and multiple cloud providers issued security bulletins (Sophos, Fortinet Outbreak Alert, SANS ISC).