Node2Shell Brotli Flaw Patches Issued and KEV Added
First merged summary.
CVE-2026-111497 Node2Shell out-of-bounds write in Brotli decoder patched in Node.js Microsoft .NET Python and Google libraries; CISA added to KEV with reported honeypot attempts.
An out-of-bounds write in Google's Brotli decoder CVE-2026-111497 dubbed Node2Shell enables remote unauthenticated code execution memory disclosure denial of service or crashes when processing attacker-controlled compressed data. Node.js disclosed the issue October 21 and released fixes for lines 22 24 and 26; Microsoft issued emergency .NET updates October 25; Google Python package maintainers and others followed with patched Brotli releases. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog October 27 requiring remediation by November 10. Some honeypot attempts and exploit traffic have been logged but no widespread confirmed remote code execution in the wild is reported.
- Affects Brotli 1.0.3-1.2.0 fixed in 1.0.10 1.1.1 1.2.1
- Node.js fixes 22.23.4 24.22.1 26.12.1
- Microsoft .NET 8-11 updated October 25
- CISA KEV added October 27 deadline November 10
- Public PoCs exist but exploitability disputed
- EOL Node.js 20 23 25 not patched
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js discloses Brotli flaw CVE-2026-111497 and releases fixes · SecurityWeek
- Oct 25, 2026Microsoft issues out-of-band .NET patches · Infosecurity Magazine
- Oct 27, 2026CISA adds CVE-2026-111497 to KEV catalog · CISA Known Exploited Vulnerabilities
- Oct 27, 2026ELLIO reports honeypot exploit traffic · Help Net Security
- Oct 28, 2026CISA warns of active exploitation · BleepingComputer
What each outlet adds
beyond the shared facts- SecurityWeekReported Imperva lab code execution demo and Node2Shell naming
- Infosecurity MagazineDetailed Microsoft emergency .NET updates and additional CVEs
- CISA Known Exploited VulnerabilitiesOfficial KEV cataloging and federal remediation deadline
- Help Net SecurityELLIO honeypot exploit traffic reports
- BleepingComputerCISA active exploitation warnings and remediation advice
Coverage
oldest first · one row per article · UTC- · 6d ago
Cyber Security NewsFirst report
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
- · 6d ago
GBHackers
Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
- · 6d ago
Microsoft issues emergency .NET fixes for four vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.
- · 6d ago
SecurityWeek
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
- · 6d ago
SOCRadar
SOCRadar headline says Brotli flaw Node2Shell hits Python packages
The captured page is site navigation, with no CVE, versions, fix, or exploitation details.
- · 6d ago
Infosecurity Magazine
Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
- · 6d ago
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
- · 6d ago
Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
- · 6d ago
BleepingComputer
Microsoft ships emergency .NET patches for critical Brotli flaw
CVE-2026-111497 is an out-of-bounds write; public proof-of-concept exploits exist, with no reported in-the-wild attacks.
- · 6d ago
PHP Windows builds fix critical Brotli HTTP2Shell flaw
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
- · 6d ago
Akamai Blog
Akamai analyzes Node2Shell flaw CVE-2026-111497
The published outline lists vulnerability details, affected versions, and mitigations, but those specifics are not in the text.
- · 6d ago
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
- · 6d ago
oss-security
git-remote-https also hit by Brotli flaw CVE-2026-111497
The warning applies when libcurl is built with Brotli, and scans should include the older CURLOPT_ENCODING name.
- · 6d ago
Rapid7 Blog
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
- · 6d ago
The Hacker News
PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
- · 6d ago
The Register · Security
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
- · 5d ago
CISA Known Exploited Vulnerabilities
CISA lists exploited Google Brotli flaw CVE-2026-111497
A crafted Brotli stream can corrupt decoder memory, leak data, cause denial of service, or run code.
- · 5d ago
CyberScoop
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
- · 5d ago
Tenable Blog
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
- · 5d ago
Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
- · 5d ago
CSO Online
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
- · 5d ago
Help Net Security
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
- · 5d ago
Cisco Security Advisories
October 2026 Node.js flaws affect Cisco products, Cisco says
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
- · 4d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
- · 4d ago
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
- · 4d ago
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
- · 4d ago
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
- · 4d ago
CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
- · 4d ago
Canadian Centre for Cyber Security
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
- · 4d ago
Zscaler ThreatLabz
Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |