CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Original title: CISA Warns of Active Attacks Exploiting Critical Node2Shell RCE Vulnerability in Node.js
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
CISA added CVE-2026-111497, called Node2Shell, to the Known Exploited Vulnerabilities catalog on October 27 after confirmed exploitation. The defect is in Google’s Brotli decoder and can let unauthenticated attackers corrupt memory, disrupt services, disclose data, or run code through crafted compressed streams. Google lists fixes in Brotli 1.0.10, 1.1.1 and 1.2.1. Node.js security updates are 22.23.4, 24.22.1 and 26.12.1; unsupported 20.x, 23.x and 25.x need migration.
Unconfirmed: ELLIO says the captured attacker chain failed in lab tests, while a separate validated chain obtained a shell.
- CVSS is 9.2; the flaw combines unchecked return values with an out-of-bounds write.
- ELLIO reproduced shells on Node.js 24.22.0 Express, Koa, plain HTTP and a container.
- A 23,069,983-byte request from 94.154.43.7 on October 26 failed in 50 lab attempts.
- Failed crashes can still interrupt service and leave secrets in core dumps.
- Rejecting inbound Brotli bodies does not stop malicious compressed responses.
Impact: Unauthenticated memory corruption, disclosure, or code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | release branches beginning with 1.0.3 | 1.0.10, 1.1.1, and 1.2.1 |
| Node.js | vulnerable builds including 24.22.0; unsupported 20.x, 23.x, and 25.x | 22.23.4, 24.22.1, or 26.12.1 |
- 1.Install Node.js 22.23.4, 24.22.1, or 26.12.1 and migrate unsupported branches.
- 2.Update other bundled Brotli implementations and rebuild containers.
- 3.Verify runtime release versions rather than process.versions.brotli.
- CVEs
- CVE-2026-111497
- Vendors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 94.154.43.7 | ELLIO observed a 23,069,983-byte exploitation request from 94.154.43.7, targeting the official Node.js 24.22.0 x86-64 binary. Impo |
From the original article
2 min read at gbhackers.com
CISA has added CVE-2026-111497, a critical vulnerability in Google Brotli that affects Node. js, to its Known Exploited Vulnerabilities catalog following confirmed evidence of exploitation. Added on October 27, 2026, this flaw allows unauthenticated attackers to corrupt memory, disrupt services, disclose sensitive information, or potentially execute arbitrary code through maliciously crafted compressed streams.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.