Node2Shell: a critical flaw in the Brotli compression library is added to CISA's exploited list six days after fixes
October 27, 2026 (Fixed October 21, listed as exploited October 27, 2026)
CVE-2026-111497 (CVSS 9.2), also called HTTP2Shell and Broccoli2Shell, is an out-of-bounds write in the decoder of Google's Brotli compression library, versions 1.0.3 through 1.2.0. A specially crafted compressed stream can crash an application, leak memory or let an unauthenticated attacker run code. Researchers at OpenAI reported it, and Node.js and Google shipped fixes on October 21. CISA added it to its exploited list on October 27 with a federal deadline of November 10 and gave no details of the attacks. ELLIO, a lab that watches for mass scanning, logged a malicious request aimed at Node.js 24.22.0 on October 26, but that attacker's own final stage produced no shell in any of ELLIO's 50 tests. Imperva has shown code execution on an official Node.js image. The affected software goes beyond Node.js: Microsoft .NET and PowerShell, Python packages, Palo Alto's PAN-OS, and the SDDC Manager in VMware Cloud Foundation and vSphere Foundation, which Broadcom flagged on October 27.
Why it matters
Brotli is used across web servers, browsers and content networks, and data is often decompressed before application-level checks run, so the flaw sits in places that are easy to overlook. The practical task is finding every product that bundles the library.
What defenders can take from it
- Update Node.js and any software that bundles Brotli, then restart services and rebuild container images.
- If you cannot update yet, block Brotli-compressed requests at the proxy or firewall, or turn off Brotli decoding.
- Ask the vendors of appliances and developer tools whether their products ship Brotli.
Sources
- BleepingComputer: CISA warns of hackers now exploiting critical Node2Shell flaw
- SecurityWeek: CISA warns of Node2Shell exploitation as honeypots log attack attempts
- Sophos: Node2Shell (CVE-2026-111497) in active exploitation
- SC Media: Node2Shell flaw in Brotli added to CISA exploited vulnerabilities list