CISA lists Brotli Node2Shell flaw as honeypots log attempts
Original title: CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
CISA added the Brotli out-of-bounds write CVE-2026-111497, also called Node2Shell, HTTP2Shell and Broccoli2Shell, to its KEV catalog on October 27 without describing the attacks. Crafted compressed data can crash an application, expose memory, or potentially run code. Node.js and Google fixed Brotli on October 21; Microsoft, Python package maintainers, Bun, Envoy, Istio and Palo Alto Networks have also shipped fixes. Previdian and ELLIO each report a honeypot attempt, and ELLIO says the payload it saw did not produce a shell.
Unconfirmed: CISA gave no attack details, and ELLIO says the exploit it observed did not yield a shell.
- Previdian logged one October 27 attempt from a US IP and rates exploitation confidence as confirmed.
- ELLIO saw a request on October 26 against Node.js 24.22.0 on x86-64; its final stage failed in 50 tests.
- Broadcom says SDDC Manager is affected, CVSS 9.8 on 9.1.1, with patches still pending.
- Failed attempts can crash the process and be used for denial of service.
Impact: Crash, memory disclosure, or potential arbitrary code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 through 1.2.0 | fixes released October 21 |
| Broadcom SDDC Manager | 9.1.1, 9.0.x, 9.1.0 and 5.2.x | — |
- 1.Federal civilian agencies must address CVE-2026-111497 by November 10.
- 2.Apply the October 21 Brotli, Node.js and related vendor fixes.
- 3.Use Broadcom’s published workarounds until SDDC Manager patches ship.
- CVEs
- CVE-2026-111497
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at securityweek.com
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.