KB-2427 Information about CVE-2026-111497 (also known as Broccoli2Shell, Node2Shell, or HTTP2Shell)
On October 20, 2026, A vulnerability was disclosed in the Brotli compression library's C decoder (CVE-2026-111497, also referenced as "Broccoli2Shell" / "Node2Shell"). Brotli is a widely used, general-purpose data-compression library included in many operating systems and runtimes.
Upon assessing the Appian platform against all details of the CVE, we can confirm that the Appian Cloud platform is affected by CVE-2026-111497 but is not currently vulnerable to exploitation due to the following compensating controls:
- The web tier does not enable Brotli handling.
- Appian's shipped components do not expose a path where externally supplied, Brotli-compressed content is decoded.
The Brotli library is present only as part of the underlying operating system. Appian does not enable or invoke this functionality in a way that processes untrusted input.
As a result, there is no customer-reachable exposure to this vulnerability in Appian.
Appian keeps its underlying operating-system components current through its regular maintenance process. When the platform vendor publishes an updated package for this library, Appian incorporates it automatically as part of the standard weekly maintenance hotfixes — no separate action or special release isrequired.
Additional Notes:
The following CVE was released with additional information on the scope of the vulnerability:
CVE-2026-111497 - (A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli)
Supporting Documentation:
- https://broccoli2shell.com/
- https://semgrep.dev/blog/2026/broccoli2shell-brotli-cve-2026-111497/
Affected Versions
This article applies to all supported versions of Appian.
Last Reviewed: November 2, 2026