On Tuesday 27 October the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have started exploiting CVE-2026-111497, the Brotli decoder flaw known as Node2Shell, Broccoli2Shell and HTTP2Shell, and added it to its Known Exploited Vulnerabilities catalog. We have followed the bug since the Node.js security release on 22 October, the list of other affected products on 24 October and the Brotli-related coverage of OpenAI’s disclosure on 25 October. As of 22 October, no exploitation in the wild had been reported; that has now changed.
The flaw is an out-of-bounds write in the Brotli decoder, which expands data compressed with Google’s Brotli algorithm. BleepingComputer says an unprivileged attacker can send a crafted Brotli stream to cause crashes or memory leaks and, in some cases, run code on systems with a vulnerable Brotli library or binary. CISA’s catalog entry describes it as an unchecked return value that lets a remote, unauthenticated attacker corrupt adjacent decoder memory, disclose memory contents, cause a denial of service or potentially execute code. CISA gave US federal agencies until 10 November to patch under Binding Operational Directive 26-04, and urged all network defenders to prioritise it. BleepingComputer also reports that Microsoft pushed an emergency .NET security update on Sunday, warning the flaw could be used to escalate privileges on systems running a vulnerable .NET version. This post does not cover the .NET update’s version numbers; use Microsoft’s own bulletin for those.
How to check if you’re affected
Affected products are any servers, clients or applications that decode Brotli data from an untrusted source using a vulnerable Brotli library or runtime. That includes Node.js, which is where the flaw was first identified, and other HTTP servers and clients that rely on vulnerable Brotli implementations.
- Node.js: Imperva’s analysis says the fixed releases are 22.23.4, 24.22.1 and 26.12.1, and that code execution was reproduced through
node:zlib, throughfetch()on a Brotli-compressed response, and through Express 5 and body-parser 2 when their parsers are configured to decode Brotli request bodies. Check the Node.js version inside every deployed host and container image, because a package inventory can miss an older runtime bundled in an image. - Other products: see our earlier list covering Bun, Python Brotli packages, Envoy and Istio, and Aikido’s write-up on affected Python packages.
- If you cannot update yet: BleepingComputer says to block incoming Brotli-compressed requests at the proxy or firewall, or disable Brotli decoding, until you can update.
- After patching: restart the affected processes and rebuild and redeploy affected container images.
Sources
- NVD: CVE-2026-111497
- CISA: adds two known exploited vulnerabilities to catalog (27 October 2026; page returned 403 to our checker, linked from BleepingComputer)
- Imperva: Node2Shell, from Brotli data to remote code execution
- Aikido: Python packages vulnerable to Node2Shell (Brotli, CVE-2026-111497)
- BleepingComputer: CISA warns of hackers now exploiting critical Node2Shell flaw