The US Cybersecurity and Infrastructure Security Agency (CISA) on October 27 added CVE-2026-111497, the Brotli decoder flaw known as Node2Shell, to its Known Exploited Vulnerabilities (KEV) catalog. The listing rests on evidence of active exploitation and gives federal civilian agencies until November 10 to patch.
Key Facts
- Node2Shell, also called HTTP2Shell and Broccoli2Shell, is a critical out-of-bounds write in the decoder of Google’s Brotli compression library.
- Brotli versions 1.0.3 through 1.2.0 are affected, and crafted compressed data can crash an app, leak its memory or potentially run code.
- CISA disclosed no details about the attacks, while two security firms say their honeypots have logged exploitation attempts.
- Adobe Commerce and Magento joined the catalog in the same update through CVE-2026-48356, a dangerous file upload flaw.
CISA lists the bug six days after fixes shipped
Node.js and Google released fixes on October 21, after researchers at OpenAI reported the bug. It first surfaced in the Node.js runtime. HTTP servers and clients built on a vulnerable Brotli implementation are exposed too, because the weak point is the decoder that expands incoming data.
CISA’s catalog entry spells out what an attacker gets: “Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.“
That “unchecked return value” label differs from the out-of-bounds write classification in the NVD record, though both describe corrupted decoder memory. The code-execution path isn’t theoretical either. Imperva has demonstrated remote code execution against an official Node.js image.
CISA has added the Brotli “Node2Shell” flaw (CVE-2026-111497) to its exploited-vulnerabilities list. Attackers are using it, and US agencies must patch by Nov 10. If you run Node.js, .NET, Envoy or PAN-OS, update now, then restart services and rebuild containers. https://t.co/Pr5YFkQnKT
— SQ Magazine (@sqmagazine_news) October 28, 2026
Patches reach from Node.js to PAN-OS firewalls
The patch list shows how far one compression library travels once it’s bundled into other software:
- Microsoft pushed an emergency .NET security update for the Brotli flaw. It warned that attackers could escalate privileges on vulnerable .NET versions.
- Maintainers of two Python packages released fixed versions.
- Bun, the Envoy proxy and the Istio service mesh have shipped fixes as well.
- Palo Alto Networks is still rolling out PAN-OS hotfixes.
Several of those products sit at the network edge. That placement could put a vulnerable decoder directly in front of untrusted traffic, well before any application code sees a request. A crash at that layer could knock out traffic for every service sitting behind it.
CISA left the attack details blank
The agency’s KEV alert says nothing about who is exploiting the flaw or which products they’re hitting. According to SecurityWeek, two security firms have recorded exploitation attempts against their honeypots. Honeypot hits show active probing, but they don’t prove that a production system was breached.
The gaps matter for triage. Are attackers reaching code execution, or only crashing services? Which Brotli consumers are they aiming at, and when did the activity start? Without those answers, defenders have to treat every exposed Brotli decoder as a likely target.
The Adobe Commerce and Magento entry carries even less detail. CISA names only its weakness class: unrestricted upload of a file with a dangerous type.
Teams that can’t patch right away have two stopgaps. They can block incoming Brotli-compressed requests at the proxy or firewall, or switch off Brotli decoding, which helps reduce risk until updates land.
What’s Next?
Patching alone doesn’t finish the job: administrators also need to restart affected processes and rebuild and redeploy container images. A fixed library on disk does nothing for a process still running the old code. Anyone whose exposed services ran a vulnerable build should also look for signs of compromise from before the fix. Binding Operational Directive (BOD) 26-04 now sets that expectation for federal agencies.
The directive puts KEV flaws on publicly exposed assets that grant total control at the front of the queue, while lower risk bugs can wait. A remotely triggered bug with code-execution potential on internet-facing servers fits that first group, which explains the short November 10 deadline. For private networks, the open item is Palo Alto’s hotfix rollout. PAN-OS customers will need to watch the vendor advisory for their specific release.
