CVE-2026-111497
CriticalAdvisory
Published 22 Oct 2026In the index since 23 Oct 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.2
- base score, highest
- EPSS
- 0.005
- 41st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 2,321
- of 18,232 indexed, latest versions
- Container images
- 2,195
- deployed by those charts
- Fix available
- 6 of 7
- affected packages
Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
Carried by container images the latest versions of 2,321 of 18,232 indexed charts deploy, on 2,195 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| brotlideb | 1.0.7-6ubuntu0.1, 1.0.9-2+b2, 1.0.9-2+b6, 1.0.9-2build6+5 more | 1.0.9-2+deb12u1, 1.1.0-2+deb13u1, 1.2.0-4+e1 | 1,478 |
| brotliapk | 1.0.9-r14, 1.1.0-r2, 1.2.0-r0, 1.2.0-r1 | 1.1.1-r0, 1.2.1-r0 | 639 |
| brotlipypi | 1.0.9, 1.1.0, 1.2.0 | 1.2.1 | 107 |
| nodejsdeb | 4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+48 more | no fix listed | 72 |
| nodebitnami | 18.4.0-0, 18.7.0-1, 18.12.1-0, 18.13.0-0+8 more | 22.23.4 | 24 |
| Node.jsbitnami | 20.4.0, 20.5.1, 20.8.0, 20.9.0+1 more | 22.23.4 | 7 |
| brotlicffipypi | 1.2.0.1, 1.2.0.2 | 1.2.1.0 | 3 |
- OSV records
- ALPINE-CVE-2026-111497BIT-node-2026-111497DEBIAN-CVE-2026-111497ECHO-1099-6733-474bPYSEC-2026-4322PYSEC-2026-4323UBUNTU-CVE-2026-111497
- Also known as
- BIT-node-min-2026-111497
- Trending
- Rank 1 in indexed charts, since 24 Oct 2026. See the ranking →
Charts affected
2,321 by stars
Container images carrying it
2,195 by charts deploying them
A fixed version is listed for 6 of the 7 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| fireflyiii/ | ab52bf932546 | brotli | 1.1.0-2+deb13u1 | 1 |
| fiware/ | 29456835bb2c | brotli | no fix listed | 1 |
| fiware/ | d551a13e8278 | brotli | 1.0.9-2+deb12u1 | 1 |
| fluent/ | 6806769c10ac | brotli | 1.1.0-2+deb13u1 | 1 |
| fluent/ | e76397ef3983 | brotli | 1.0.9-2+deb12u1 | 1 |
| flyway/ | 45b5d7cdc75a | brotli | no fix listed | 1 |
| fnzv/ | b3079b95c336 | brotli | no fix listed | 1 |
| folioci/ | f0655a6a08fd | brotli | 1.2.1-r0 | 1 |
| folioci/ | 2493041ce880 | brotli | 1.1.0-2+deb13u1 | 1 |
| fosrl/ | 5039d0e64a2e | brotli | 1.0.9-2+deb12u1 | 1 |
| fosrl/ | c32ad797ab96 | brotli | 1.2.1-r0 | 1 |
| frankescobar/ | 4154286c0209 | brotli | no fix listed | 1 |
| frankescobar/ | dc171ec796d5 | brotli | no fix listed | 1 |
| freeradius/ | af6fd34a5b78 | brotli | no fix listed | 1 |
| freshrss/ | 840765ea01fb | brotli | 1.2.1-r0 | 1 |
| frinx/ | 59aa36c359f2 | brotli | no fix listed | 1 |
| frinx/ | d01264a908c9 | brotli | no fix listed | 1 |
| frinx/ | 17a139608024 | brotli | 1.0.9-2+deb12u1 | 1 |
| frinx/ | 5f1368ef47b8 | brotli | 1.0.9-2+deb12u1 | 1 |
| fthomas/ | 27d7486df0a0 | brotli | 1.2.1-r0 | 1 |
| galaxy/ | e5c265fe9fcd | brotli brotli | 1.2.1 no fix listed | 1 |
| galaxy/ | 0267bad550e6 | nodejs | no fix listed | 1 |
| galaxy/ | e50a890e24c9 | brotli | 1.0.9-2+deb12u1 | 1 |
| gchq/ | c460bb587d6d | brotli | no fix listed | 1 |
| geldata/ | b3a2815a3956 | brotli | 1.0.9-2+deb12u1 | 1 |
| geonode/ | 81b1d431b7e9 | brotli | no fix listed | 1 |
| geonode/ | 435cbc5f3f05 | brotli | 1.2.1-r0 | 1 |
| geoservercloud/ | 244572a8e01d | brotli | no fix listed | 1 |
| geoservercloud/ | ca58b74529cd | brotli | no fix listed | 1 |
| geoservercloud/ | 5f81a737aff3 | brotli | no fix listed | 1 |
| geoservercloud/ | 5dc0c93a1710 | brotli | no fix listed | 1 |
| geoservercloud/ | c14c7be99fd7 | brotli | no fix listed | 1 |
| geoservercloud/ | 47ae1bdb4bcc | brotli | no fix listed | 1 |
| geoservercloud/ | 54cfe408a3ef | brotli | no fix listed | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | brotli | no fix listed | 1 |
| geoservercloud/ | 3d01d85dcff4 | brotli | no fix listed | 1 |
| geoservercloud/ | 67be5bf231e1 | brotli | no fix listed | 1 |
| geoservercloud/ | 8c70ee06d5ab | brotli | no fix listed | 1 |
| geoservercloud/ | 42775ba6a4da | brotli | no fix listed | 1 |
| geoservercloud/ | 6243931b4cc7 | brotli | no fix listed | 1 |
| gethue/ | 11b649636e68 | brotli nodejs | no fix listed no fix listed | 1 |
| gethue/ | 5702b2c37ff9 | nodejs | no fix listed | 1 |
| gethue/ | 7d5c1b9f8a79 | brotli nodejs | no fix listed no fix listed | 1 |
| getsentry/ | ba7bf9163219 | brotli | 1.0.9-2+deb12u1 | 1 |
| getwud/ | b1cd01c43839 | brotli | 1.0.9-2+deb12u1 | 1 |
| ghostfolio/ | 256c524a6116 | brotli | 1.0.9-2+deb12u1 | 1 |
| ghostfolio/ | e3c6ab53e49b | brotli | 1.0.9-2+deb12u1 | 1 |
| gitea/ | 7940221bcfc9 | brotli | 1.2.1-r0 | 1 |
| gitea/ | 8368754bb612 | brotli | 1.2.1-r0 | 1 |
| gitea/ | b5c35d6bdbb9 | brotli | 1.2.1-r0 | 1 |