CISA lists exploited Brotli Node2Shell flaw; agencies face November 10 deadline
First merged summary.
CVE-2026-111497 is in CISA’s KEV catalog, with fixes available and a November 10 US agency deadline.
CISA added CVE-2026-111497, the Brotli out-of-bounds write known as Node2Shell, to its KEV catalog on October 27, requiring US civilian agencies to remediate by November 10. Crafted compressed data can crash processes, leak memory, or potentially run code wherever Brotli 1.0.3–1.2.0 is used, including Node.js. October 21 fixes are Brotli 1.0.10, 1.1.1, and 1.2.1 and Node.js 22.23.4, 24.22.1, and 26.12.1; end-of-life 20.x, 23.x, and 25.x stay unfixed. Cyber Security News, Datadog, GBHackers, and Patchstack cite CVSS 9.2; SecurityWeek reports Broadcom scores SDDC Manager 9.8 with patches pending. SecurityWeek says an ELLIO honeypot payload did not produce a shell, while GBHackers says ELLIO reproduced shells on Node.js 24.22.0. On October 30 Patchstack said stock WordPress can crash when libcurl unpacks a malicious Brotli reply.
- Affected Brotli is 1.0.3 through 1.2.0; fixes are 1.0.10, 1.1.1, and 1.2.1.
- Patched Node.js releases are 22.23.4, 24.22.1, and 26.12.1.
- Patched Node.js can still report process.versions.brotli as 1.2.0.
- Datadog says a public proof of concept appeared on October 22.
- Previdian logged one October 27 attempt from a US IP.
- Bun before 1.4.4 and Python Brotli packages also need updates.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js and Google released Brotli decoder fixes. · SecurityWeek
- Oct 22, 2026A public proof of concept appeared. · Datadog Security Labs
- Oct 26, 2026ELLIO logged a request against Node.js 24.22.0. · SecurityWeek
- Oct 27, 2026CISA added CVE-2026-111497 to the KEV catalog. · BleepingComputer
- Oct 28, 2026Canada’s Cyber Centre warned about Broccoli2Shell. · Canadian Centre for Cyber Security
- Oct 30, 2026Patchstack reported WordPress crash risk via libcurl. · Patchstack
What each outlet adds
beyond the shared facts- SecurityWeekPrevidian and ELLIO honeypot attempts; Broadcom SDDC patches pending.
- Zscaler ThreatLabzMissed block-decode check enables inbound and outbound paths.
- Datadog Security LabsOctober 22 proof of concept; Express 5 accepts Brotli by default.
- GBHackersSays ELLIO reproduced shells; a large request failed 50 times.
- PatchstackDefault WordPress can crash through xmlrpc pingback and libcurl.
Coverage
oldest first · one row per article · UTC- · 3d ago
GBHackersFirst report
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
- · 3d ago
Cyber Security News
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
- · 2d ago
SecurityWeek
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
- · 2d ago
BleepingComputer
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
- · 2d ago
CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
- · 2d ago
Canadian Centre for Cyber Security
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
- · 2d ago
Zscaler ThreatLabz
Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
- · 2d ago
Cisco Security Advisories
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
- · 2d ago
Datadog Security Labs
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
- · 2d ago
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
- · 1d ago
Ubuntu Security Notices
Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
- · 22h ago
Patchstack
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |