StoryExploit / PoCcriticalExploited in the wild

Node2Shell: Brotli Decoder OOB Write Allows Code Execution

15 sources · 19 articlesFirst reported Oct 27, 2026 · 12:34 UTCUpdated Nov 3, 2026 · 06:00 UTC (3h ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added CVE-2026-111497 Node2Shell to KEV on October 27 after exploit traffic; federal agencies must patch by November 10.

CVE-2026-111497 is a remotely exploitable out-of-bounds write in Google's Brotli decoder that can crash processes, leak memory, or execute code from crafted streams. The flaw was first found in Node.js and affects bundled decoders in .NET, Bun, Envoy, Istio, Python packages, and HTTP clients. Node.js and Google released fixes on October 21 for versions 22.23.4, 24.22.1, 26.12.1 and Brotli 1.0.10, 1.1.1, 1.2.1; end-of-life Node.js branches remain vulnerable. CISA added the CVE to its KEV catalog on October 27, 2026, following confirmed exploit attempts and a public proof-of-concept. Defenders are urged to patch or block Brotli-compressed data until updates are applied.

Key facts

CVE-2026-111497: out-of-bounds write in Brotli decoder (CVSS 9.2)
Fixed Node.js: 22.23.4, 24.22.1, 26.12.1
Fixed Brotli: 1.0.10, 1.1.1, 1.2.1
CISA KEV added: October 27, 2026
Federal deadline: November 10, 2026
Affects: Node.js, .NET, Bun, Envoy, Istio, Python

Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 21, 2026Node.js and Google patch Brotli decoder CVE-2026-111497 · Help Net Security, SecurityWeek
Oct 27, 2026CISA adds CVE-2026-111497 to Known Exploited Vulnerabilities catalog · SecurityWeek, Cyber Security News
Oct 27, 2026ELLIO reports public exploit traffic and honeypot attempts · Help Net Security, SecurityWeek
Oct 28, 2026Canadian Centre for Cyber Security issues AL26-027 alert · Canadian Centre for Cyber Security
Oct 29, 2026Datadog reproduces public PoC on Node.js 24.22.0 · Datadog Security Labs
Oct 30, 2026Patchstack warns WordPress exposed via libcurl Brotli decoding · Patchstack

What each outlet adds

beyond the shared facts

ELLIOReports exploit traffic from 94.154.43.7 and failed shell attempts in 50 lab tests
SecurityWeekHoneypot logs one confirmed October 27 attempt from US IP
Help Net SecurityLinks exploit attempts to prior PHP2Shell activity and lists additional affected projects
Cyber Security NewsDetails end-of-life Node.js branches without fixes and confirms ransomware use unknown
Datadog Security LabsReproduces crash on patched builds and notes process.versions.brotli still reports 1.2.0

CVEs: CVE-2026-111497 CVE-2026-48356

Vendors: Google Node.js Adobe Microsoft Broadcom Palo Alto Networks Wordfence
Products: Node.js Brotli Bun brotli4j .NET Envoy Istio Express Koa Microsoft .NET PowerShell Envoy Proxy
Organizations: CISA Datadog Imperva Wiz ELLIO Tenable Canadian Centre for Cyber Security Sansec Previdian Aikido Security Rapid7 OpenAI
Countries: Canada United States

Coverage

oldest first · one row per article · UTC

Oct 27, 12:34 UTC · 6d ago CSO OnlineFirst report
Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
Oct 27, 17:38 UTC · 6d ago Help Net Security
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
Oct 27, 21:30 UTC · 6d ago Cisco Security Advisories
October 2026 Node.js flaws affect Cisco products, Cisco says
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
Oct 28, 05:42 UTC · 6d ago The Hacker News
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
Oct 28, 05:44 UTC · 6d ago GBHackers
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
Oct 28, 05:44 UTC · 6d ago Cyber Security News
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
Oct 28, 08:37 UTC · 6d ago SecurityWeek
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
Oct 28, 10:05 UTC · 5d ago Security Affairs
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
Oct 28, 10:46 UTC · 5d ago BleepingComputer
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
Oct 28, 11:57 UTC · 5d ago Cyber Security News
CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
Oct 28, 12:46 UTC · 5d ago Canadian Centre for Cyber Security
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
Oct 28, 16:11 UTC · 5d ago Zscaler ThreatLabz
Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
Oct 28, 20:36 UTC · 5d ago Cisco Security Advisories
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
Oct 29, 00:00 UTC · 5d ago Datadog Security Labs
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
Oct 29, 06:39 UTC · 5d ago GBHackers
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
Oct 29, 17:02 UTC · 4d ago Ubuntu Security Notices
Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
Oct 30, 09:53 UTC · 3d ago Patchstack
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
Nov 2, 15:48 UTC · 18h ago Wordfence
Brotli vulnerability enables unauthenticated remote code execution on WordPress sites
CVE-2026-111497 corrupts memory in Brotli library used by WordPress for outbound responses; public proof-of-concept works against PHP 8.3.36.
06:00 UTC · 3h ago Help Net Security
Sweet Virtual Patching Stops HTTP2Shell Vulnerability
Sweet Virtual Patching protects Node.js and other runtimes from HTTP2Shell until permanent Brotli fixes are released.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-111497	Buffer overflow in Google Brotli decoder 1.0.3–1.2.0	9.2	83%	KEVPoC ×25	11d ago KEV Oct 27, 2026
CVE-2026-48356	Unrestricted dangerous file upload in Adobe Commerce and Magento	9.3	45%	KEV	Jul 14, 2026 KEV Oct 27, 2026