Node2Shell/Broccoli2Shell - Vulnerability in Google's C decoder (affecting Node.js, Python, ...) (CVE-2026-111497)

Siemens is aware of the vulnerability, CVE-2026-111497, referred to as Broccoli2Shell or Node2Shell, in Google's decoder. An out-of-bounds write can potentially result in a crash, a memory leak or a remote code execution in software which uses a vulnerable version of Brotli.

We are evaluating the impact to Siemens products. For Siemens products that are affected by CVE-2026-111497, as well as those that are known not affected, corresponding security advisories (SSA) will be published as soon as the related information becomes available. Siemens will also update this post.

Google Brotli and Node.js have released fixes in versions following versions:

Product	Fixed version
Google Brotli (C library)	1.0.10, 1.1.1, 1.2.1
Node.js 26	26.12.1
Node.js 24	24.22.1
Node.js 22	22.23.4
Node.js 25, 23, 20 and older	No fix. These lines are end of life, so move to 22, 24 or 26.
Python Brotli	1.2.1
Python brotlicffi	1.2.1.0

Note: Please be aware that links in the Blog Post may refer to external websites and content.