A critical vulnerability has been discovered in Brotli, a compression library developed by Google and used widely across the web. Identified as CVE-2026-111497 and commonly known as Broccoli2Shell (also called Node2Shell), it could allow an unauthenticated remote attacker to crash an affected application, expose memory contents, or potentially execute malicious code. Google has given it a severity score of 9.2 out of 10 under CVSS v4.0.

On October 21, 2026, Google and the Node.js project released fixes, and other vendors that include Brotli have since followed. DigiCert has assessed the potential impact on our products and services, and we are sharing the steps taken to protect affected infrastructure.

What is DigiCert doing to protect its systems?

DigiCert has applied the relevant security updates to affected systems. Our Web Application Firewall (WAF) blocks attempted exploitation of these vulnerabilities, providing protection beyond the relevant security patches.

Affected DigiCert products and services:

• Valimail + DigiCert [Patching Completed]
• Quantum Central [Patching Completed]
• AI Trust Manager [Patching Completed]
• Software Trust Manager [Patching Completed]

Confirmed unaffected products and services:

• CertCentral
• Trust Lifecycle Manager
• Device Trust Manager
• Gatekeeper
• Document Trust Manager  
• Content Trust Manager  
• UltraDNS

What is Node2Shell?

Node2Shell is a flaw in the part of the Brotli library that decompresses data. When it processes a specially crafted compressed stream, it can write data past the end of a memory buffer, which an attacker may be able to use to run code.

An application is at risk when it decompresses Brotli data an attacker can control, such as incoming web requests or responses from servers it connects to. Many frameworks and HTTP clients do this automatically, so an application can be exposed even if its developers never use Brotli directly.

The name comes from Node.js, which disclosed the flaw first, but the issue affects any software that includes Google’s Brotli decoder. It is not related to the PHP2Shell vulnerabilities disclosed the same week, which we covered in a separate post.

Which versions are affected?

Google Brotli versions 1.0.3 through 1.2.0 are affected, along with software that includes them. Fixed versions for widely used software are listed below.

Is it being exploited?

As of October 27, 2026, the vulnerability is not on CISA’s Known Exploited Vulnerabilities list. However, proof-of-concept code is public and researchers have demonstrated code execution in lab conditions, so we recommend updating promptly.

What do you need to do?

We do not expect this vulnerability to impact customers’ experience with DigiCert. No action is required, and all certificate operations are secure and fully operational.

If you operate software that uses Brotli, we recommend that you:

1. Update affected software to a fixed version.
2. Restart services and rebuild container images so the fix takes effect.
3. Check applications that ship their own copy of Brotli, such as Node.js, since updating the operating system alone will not fix them.

Staying informed

DigiCert continues to monitor security developments that could affect our products, services and customers. For technical details and patches, see:

Node.js security advisory

CVE-2026-111497 (National Vulnerability Database)

Google Brotli 1.2.1 release