CISA Warns of Active Exploitation of Critical Brotli Node2Shell Flaw
Summary
CISA says attackers are exploiting CVE-2026-111497, a critical Brotli decoder flaw that can cause crashes, memory disclosure, denial of service, or potentially remote code execution. It urges prompt patching and lists mitigations.
Key points
- CISA says attackers have begun exploiting the critical Brotli vulnerability CVE-2026-111497, also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
- The flaw is an out-of-bounds write in the Brotli decoder; a crafted compressed stream can cause crashes or memory leaks and may enable remote code execution.
- The issue affects vulnerable Brotli libraries or binaries, including implementations used by Node.js and HTTP servers and clients.
- CISA added the flaw to its Known Exploited Vulnerabilities Catalog and directed US federal agencies to patch by November 10, 2026.
- Organizations unable to patch immediately are advised to block incoming Brotli-compressed requests or disable Brotli decoding; after updating, restart affected processes and rebuild and redeploy affected container images.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Unchecked return value
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Block incoming Brotli-compressed requests at the proxy or firewall level.
- Disable Brotli decoding until updates can be applied.
MITRE ATT&CK
CVE
Vendors
GoogleTracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google's widely popular Brotli lossless compression algorithm.MicrosoftOn Sunday, Microsoft also pushed an emergency .NET security update, warning that attackers could exploit it to escalate privileges on systems with a vulnerable .NET version.
Products
.NETOn Sunday, Microsoft also pushed an emergency .NET security update, warning that attackers could exploit it to escalate privileges on systems with a vulnerable .NET version.BrotliOn Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell.Node.jsThe security issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.