What happened
CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on 2026-10-27 with confirmed in-the-wild exploitation; independent research (Help Net Security, Sep 27) reports the Node2Shell bug under active attack. The Google Brotli decoder mishandles an impossible block-type switch, treated as 'needs more input', so a crafted stream overflows an 8-byte internal buffer (CWE-252/CWE-787), enabling memory disclosure, DoS, or remote code execution. Fix (google/brotli commit 0ed4268) was written in Feb 2026 but not pulled into downstream projects until October.
Why it matters
The AI web layer is built on these runtimes: MCP servers, LangChain/agent webhooks, and AI gateway fronts run on Node.js/Python/Bun and auto-decompress Brotli. A memory-corruption RCE in the shared decoder is a supply-chain-scale problem — one payload can compromise a whole class of AI-serving and agent-tooling processes, and the post-Mythos time-to-exploit pressure means defenders have days, not months.
Attack vector
A crafted Brotli-compressed stream is auto-decompressed by an HTTP client/server (request body via inflation middleware, or a fetch() response), corrupting adjacent decoder-state memory. Reachable from the open internet wherever an AI application or agent tool accepts Brotli-encoded traffic.
Affected systems
Google Brotli 1.0.3–1.2.0 (libbrotlidec); Node.js <22.23.4 / <24.22.1 / <26.12.1 (no fix on EOL branches); Bun ≤1.4.3; Python brotli ≤1.2.0 / brotlicffi ≤1.2.0.x; bundled copies in .NET, PHP, Ruby, DuckDB, ClickHouse
Mitigation
Upgrade to Node.js 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, brotli/brotlicffi 1.2.1.x, and Google Brotli 1.2.1. Move off EOL Node branches. Disable Brotli inflation on body parsers where not required.