GHSA-9v8h-qqgm-4m35 BIT-brotli-2026-111497 BIT-dotnet-2026-111497 BIT-dotnet-sdk-2026-111497 BIT-node-2026-111497 BIT-node-min-2026-111497 BIT-powershell-2026-111497 CVE-2026-111497 PYSEC-2026-4322 PYSEC-2026-4323

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

Critical Known exploited PyPI

Severity: 9.2 / 10; Critical · CVSS 4.0
Exploit chance (EPSS): 82.64%; Chance of exploitation in the next 30 days. Higher than 99.67% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Oct 27, 2026
Weakness: CWE-252 Unchecked Return Value
Fix: Available; 2 packages have a fixed version

Exploited in the wild. Google Brotli Unchecked Return Value Vulnerability (Google Brotli). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Nov 10, 2026.

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Affected versions

PyPI

Package	Vulnerable	Fixed in
brotli	`>= 1.0.3, < 1.2.1`	`1.2.1`
brotli	`>= 1.0.3, < 1.2.1`	`1.2.1`
brotli	`< 1.2.1`	`1.2.1`
brotlicffi	`>= 1.0.3, < 1.2.1.0`	`1.2.1.0`
brotlicffi	`>= 1.0.3, < 1.2.1.0`	`1.2.1.0`
brotlicffi	`< 1.2.1.0`	`1.2.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

brotli PyPI → `1.2.1`

pip

pip install --upgrade "brotli>=1.2.1"

poetry

poetry add "brotli>=1.2.1"

uv

uv add "brotli>=1.2.1"

brotlicffi PyPI → `1.2.1.0`

pip

pip install --upgrade "brotlicffi>=1.2.1.0"

poetry

poetry add "brotlicffi>=1.2.1.0"

uv

uv add "brotlicffi>=1.2.1.0"

Severity breakdown

CVSS 4.0 9.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-252: Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

How to prevent it

Implementation: Check the results of all functions that return a value and verify that the value is expected.
Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Implementation: Ensure that you account for all possible return values from the function.
Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.

References

Advisories

Fixes and patches

Packages

Timeline

Oct 22, 2026 Published
Oct 27, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Oct 30, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score
Nov 10, 2026 Remediation due for U.S. federal agencies

Advisory	Severity	Why it's related
GHSA-5v8v-66v8-mwm7 Integer overflow in the bundled Brotli C library	Critical	Also affects brotli
GHSA-rfgv-xxqx-mfg5 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol	High	Same weakness, CWE-252
EEF-CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres	Not rated yet	Same weakness, CWE-252
GHSA-9mr8-pwpw-3j2w Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability	High	Same weakness, CWE-252
GHSA-qh5g-q395-cx4j ImageMagick: Heap-use-after-free via XMP profile could result in a crash	Medium	Same weakness, CWE-252
GHSA-jcqp-6r6f-3mfx ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression	Medium	Same weakness, CWE-252
GHSA-wh8p-h9hw-x2mc uutils coreutils has an Unchecked Return Value Issue	Low	Same weakness, CWE-252
GHSA-wj8w-pjxf-9g4f ImageMagick has uninitialized pointer dereference in JBIG decoder	High	Same weakness, CWE-252

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor