CVE-2026-111497: One Brotli Bug, Nine Runtimes, and the Codex Agent That Found It

The awkward thing about CVE-2026-111497 is that it is not one vulnerability in one product. It is one out-of-bounds write in Google's Brotli decompressor, and the same bug is reachable through at least eight separate runtimes and proxies that embed the library — Node.js, .NET and ASP.NET Core, Python's Brotli and brotlicffi, Bun, Envoy, Istio, and the pure-Go implementation. Wiz's measurement puts 91% of cloud environments at risk and notes that 82% of them expose Node.js publicly. CISA has added it to the Known Exploited Vulnerabilities catalog, and Microsoft shipped an emergency patch for .NET and Visual Studio.

The second half of the story is who found it: Khai Tran and Sylvie Mayer of OpenAI Codex Security, according to Wiz's write-up and the upstream credits. That is an AI security agent team, and the flaw it found sits in the single most widely embedded decompression library on the web.

What the bug does

Brotli is what almost every HTTP stack decompresses when a server sends code>Content-Encoding: br/code>. A malformed compressed stream causes an out-of-bounds write during decompression, and the CVSS v4 score is 9.2. The affected range is Brotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1.

What makes it a programme rather than a ticket is that the library is vendored, statically linked, or reimplemented in each runtime, so the fix arrives through a different release train in every case — and sometimes not at all, because a language's standard distribution has its own copy.

The patch list, which is the useful part

Every figure below is from Wiz's advisory summary and the respective project releases, read on 30 October 2026.

• Google Brotli / libbrotli — affected 1.0.3–1.2.0, excluding patched backports; fixed in 1.0.10, 1.1.1, 1.2.1.

• Python Brotli — affected 1.0.3–1.2.0; fixed in 1.2.1. brotlicffi — affected 1.0.3–1.2.0.x; fixed in 1.2.1.0.

• Node.js — affected 22.x, 24.x and 26.x; fixed in 22.23.4, 24.22.1 and 26.12.1.

• Bun — affected 1.0.21–1.4.3; fixed in 1.4.4.

• Envoy Proxy — affected 1.36.11, 1.37.7, 1.38.5, 1.39.2; fixed in 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0.

• Istio — affected 1.29.0–1.29.8, 1.30.0–1.30.5, 1.31.0–1.31.1; fixed in 1.29.9, 1.30.6 and 1.31.2.

• andybalholm/brotli (Go) — affected before v1.2.7; fixed in v1.2.7.

The Node.js row is the one that decides most people's week. A service on 22.22.x is exposed through its HTTP stack even if its application code never mentions Brotli, because the decompression happens before your handler is called. That also explains the three names the industry attached to it: Node2Shell for the Node path, HTTP2Shell for the proxy path Check Point documented, and Brotli2Shell from JFrog for the broader picture.

Why "91%" is the number to argue with

Wiz's figures describe Wiz customers' cloud estates, not the internet. A count of environments with a vulnerable library somewhere in them is not a count of exploitable services, and the difference is large: a bundled Brotli inside a desktop application that never decompresses untrusted input is a finding, not a vulnerability. The useful version of the statistic is narrower — services that accept compressed input from untrusted sources, which is essentially every public HTTP endpoint terminating code>br/code>.

Two things make exploitation plausible rather than theoretical: CISA's addition to the KEV catalog implies observed exploitation, and honeypot operators have logged attempts. When a flaw crosses into the exploited-in-the-wild column, the patch deadline stops being your change-control calendar and becomes someone else's.

The discovery is the part with a longer half-life

A frontier model's security team found a memory-safety bug in a decompression library that has been read by thousands of people over a decade. That is not a story about one vendor being clever; it is a statement about coverage. Static analysis has been pointed at Brotli for years, fuzzing harnesses exist, and the bug survived both — while an agent designed to read code with intent found it and produced a fix that upstream accepted.

The asymmetry cuts both ways. The same capability that finds this class of bug will find it in the code you ship. The question for anyone operating agentic coding is not whether the agent can spot an out-of-bounds write; it is whether the finding gets to you before it gets to someone else.

What to do, in the order that matters

• Patch the runtimes you actually run. The library list above is the source; start with the ones terminating public traffic.

• Then look for vendored copies. Container base images, static binaries, WASM builds and language wheels each carry their own Brotli, and none of them will show up in a package-manager audit of the application. A repository-level inventory scanner published this week walks a filesystem and grades every Node, Bun and Brotli copy it finds, which is a faster start than inventing one.

• Rebuild rather than patch, where you can. Replacing a statically-linked library inside a built artefact is where people accidentally ship a half-fixed binary.

• If you run Envoy or Istio as an edge, treat the proxy fixes as the highest priority of the set: the proxy decompresses on behalf of everything behind it.

• Check your .NET estate separately. Microsoft's patch covers .NET and Visual Studio, and the correct version is a runtime update rather than a package reference change.

Where this sits for our readers

Most of what this blog covers is model capability, price and routing. This belongs here because of one line: the defect was found by an AI agent, and the class of system that finds such bugs is the class of system our readers are wiring into their pipelines. A repo-scanning agent that runs in CI against your dependencies is now a security control, and it is the same agent runtime that writes your code.

OrcaRouter's Agent Firewall grades tool and MCP calls before they execute, which is the control that limits an agent's blast radius; it does not make an agent's findings correct, and nothing about this CVE is a claim that routing a model reduces supply-chain risk. The useful thing to take from the week is narrower and checkable: if you gave an agent repository read access to find bugs, verify that its proposed patches are pinned, and verify that the runtime underneath your own stack has moved past 1.0.3–1.2.0.

The pattern worth remembering is that the vulnerability was in code nobody chose. Brotli arrived as a transitive dependency of a runtime feature, was fixed in eight places on separate schedules, and will keep arriving inside base images that were built before this week. Supply-chain response is mostly the discipline of finding the copies you did not install.

Sourcing note: the affected and fixed version matrix, the runtime list and the 91%/82% exposure figures are from Wiz's advisory summary read on 30 October 2026, and the fixed versions are the projects' own releases. The 9.2 CVSS v4 score is from the CVE record. The discovery credit to OpenAI Codex Security's Khai Tran and Sylvie Mayer is from Wiz's write-up and the upstream credits. CISA's KEV listing and Microsoft's .NET patch are the respective organisations' announcements; neither was read as a primary document here beyond the advisory summary. The inventory-scanner description is a third-party GitHub project's own description.