Node2Shell/Broccoli2Shell - Vulnerability in Google's C decoder (affecting Node.js, Python, ...) (CVE-2026-111497)
Siemens is aware of the vulnerability, CVE-2026-111497, referred to as Broccoli2Shell or Node2Shell, in Google's decoder. An out-of-bounds write can potentially result in a crash, a memory leak or a remote code execution in software which uses a vulnerable version of Brotli.
We are evaluating the impact to Siemens products. For Siemens products that are affected by CVE-2026-111497, corresponding security advisories (SSA) will be published as soon as the related information becomes available. The following information is currently available:
- SSA-898633: Node2Shell Vulnerability in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
- SSA-443410: Node2Shell Vulnerability in Industrial Edge Management Applications
- SSA-045512: Node2Shell Vulnerabilities in Siemens Products
Google Brotli and Node.js have released fixes in versions following versions:
| Product | Fixed version |
|---|---|
| Google Brotli (C library) | 1.0.10, 1.1.1, 1.2.1 |
| Node.js 26 | 26.12.1 |
| Node.js 24 | 24.22.1 |
| Node.js 22 | 22.23.4 |
| Node.js 25, 23, 20 and older | No fix. These lines are end of life, so move to 22, 24 or 26. |
Python Brotli |
1.2.1 |
Python brotlicffi |
1.2.1.0 |
Note: Please be aware that links in the Blog Post may refer to external websites and content.