critical9.2
CVE-2026-111497 Known exploitedFix available
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
brotlicffi PyPI
| Affected range | Recorded fix |
|---|---|
| From 1.0.3 before 1.2.1.0Ecosystem versions | 1.2.1.0 |
Version evidence: OSV · GHSA-9v8h-qqgm-4m35
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.0.3"
},
{
"fixed": "1.2.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.9.0",
"1.0.9.1",
"1.0.9.2",
"1.1.0.0",
"1.2.0.0",
"1.2.0.1",
"1.2.0.2"
]
}brotlicffi PyPI
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.2.1.0Ecosystem versions | 1.2.1.0 |
Version evidence: OSV · PYSEC-2026-4323
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.8.0",
"1.0.9.0",
"1.0.9.1",
"1.0.9.2",
"1.1.0.0",
"1.2.0.0",
"1.2.0.1",
"1.2.0.2"
]
}