CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Original title: CISA warns of hackers now exploiting critical Node2Shell flaw
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
CISA said attackers are exploiting CVE-2026-111497, an out-of-bounds write in the Brotli decoder also called Node2Shell, Broccoli2Shell, and HTTP2Shell. A crafted Brotli stream can crash processes, leak memory, or in some cases execute code on systems using vulnerable Brotli libraries, including Node.js and HTTP servers and clients. CISA added the flaw to the KEV catalog on Tuesday and gave US agencies until November 10 under BOD 26-04. Microsoft separately shipped an emergency .NET update warning of privilege escalation on vulnerable .NET versions.
Unconfirmed: The text does not name the attackers or state which products have fixed builds.
- CISA describes an unchecked return that can corrupt adjacent decoder state memory.
- The issue was first found in Node.js and also hits HTTP stacks using vulnerable Brotli.
- Defenders who cannot patch should disable Brotli decoding at the proxy or firewall.
- After updates, restart processes and rebuild and redeploy affected container images.
Impact: Memory corruption, leaks, denial of service, or possible code execution
| Product | Affected |
|---|---|
| Google Brotli | — |
| Node.js | — |
| Microsoft .NET | vulnerable .NET version |
- 1.US federal agencies must patch by November 10 under BOD 26-04.
- 2.Block incoming Brotli-compressed requests or disable Brotli decoding until updates can be applied.
- 3.After patching, restart affected processes and rebuild and redeploy container images.
- CVEs
- CVE-2026-111497
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at bleepingcomputer.com
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.