CISA lists exploited Node2Shell flaw CVE-2026-111497
Original title: Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
CISA added CVE-2026-111497, called Node2Shell, to the Known Exploited Vulnerabilities catalog on October 27, 2026, after live exploit traffic hit Node.js servers. The flaw is an out-of-bounds write in the Google Brotli decoder, scored 9.2, that a remote attacker can use to corrupt memory, leak data, crash an app, or possibly run code. Fixed Brotli releases are 1.0.10, 1.1.1 and 1.2.1. End-of-life Node.js 20.x, 23.x and 25.x will not be fixed. Ransomware use is listed as unknown.
Unconfirmed: CISA marks ransomware use as unknown and does not require forensic triage under BOD 26-04.
- CISA says federal agencies must remediate by November 10, 2026.
- Affected Node.js lines include 22.x, 24.x and 26.x plus EOL branches.
- Google Brotli 1.0.3 through 1.2.0 is affected on all platforms.
- Bun before 1.4.4 and Python Brotli and brotlicffi also need updates.
- process.versions.brotli can still show 1.2.0 on patched Node.js builds.
Impact: Unauthenticated memory corruption, data leak, crash, or code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1, and 1.2.1 |
| Node.js | 22.x, 24.x, 26.x, and EOL 20.x, 23.x, 25.x | 22.23.4, 24.22.1, and 26.12.1 |
| Oven Bun | before 1.4.4 | 1.4.4 |
| Google Python Brotli | — | 1.2.1 |
| brotlicffi | — | 1.2.1.0 |
- 1.Install Node.js 22.23.4, 24.22.1, or 26.12.1, or Brotli 1.0.10, 1.1.1, or 1.2.1.
- 2.Federal civilian agencies must remediate by November 10, 2026.
- 3.Check the Node.js release, not process.versions.brotli, which can still read 1.2.0.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 94.154.43.7 | 927844f3b772668204737a4e7602a2290c991c93c5c4b. It came from 94.154.43.7, an address ELLIO rates as malicious with high confidence. |
| sha256 | 7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b | TC. ELLIO saw a single 23,069,983-byte request with SHA-256 7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b. It came from 94.154.43.7, an address ELLIO rates as malici |
From the original article
6 min read at cybersecuritynews.com
CISA has added the Node2Shell flaw, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities catalog. Attackers are already sending live exploit traffic at Node. js servers, so teams should patch right away.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.