Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

CISA Adds Node2Shell Brotli Decoder Flaw to KEV

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added exploited Brotli decoder CVE-2026-111497 to KEV catalog on October 27, 2026.

CISA added CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder also called Node2Shell, to its Known Exploited Vulnerabilities catalog on October 27 after live exploitation. Crafted Brotli-compressed streams can corrupt decoder memory, leak data, cause denial of service, or execute code. The flaw affects Node.js and other software bundling the vulnerable library. Node.js and Google released fixes on October 21; US federal agencies must remediate by November 10 under BOD 26-04. Public proof-of-concept exploits exist, and honeypot attempts are reported.

Key facts
  • CVE-2026-111497 in Brotli decoder
  • Fixed in Brotli 1.0.10, 1.1.1, 1.2.1
  • Node.js fixes: 22.23.4, 24.22.1, 26.12.1
  • CISA KEV added: 2026-10-27
  • Federal deadline: November 10, 2026
  • Affects Node.js, .NET, Bun, Envoy, Istio, Python
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Node.js and Google release Brotli decoder fixes · Help Net Security
  2. Oct 26, 2026ELLIO observes exploit traffic against Node.js · Help Net Security
  3. Oct 27, 2026CISA adds CVE-2026-111497 to KEV catalog · Cyber Security News
  4. Oct 27, 2026Canadian Centre issues AL26-027 alert · Canadian Centre for Cyber Security
  5. Oct 28, 2026SecurityWeek reports honeypot attempts · SecurityWeek
  6. Oct 30, 2026Patchstack reports WordPress XML-RPC impact · Patchstack

What each outlet adds

beyond the shared facts
  • Canadian Centre for Cyber SecurityOfficial government alert listing affected software
  • Datadog Security LabsReproduction and patched Node.js version check
  • PatchstackWordPress XML-RPC pingback exploitation details
  • WordfenceWordPress Brotli library PoC and PHP-specific testing
  • BleepingComputerMicrosoft .NET emergency update mention
CVEs
CVE-2026-111497
Vendors
GoogleNode.jsMicrosoftBroadcomPalo Alto NetworksWordfence
Products
Node.jsBrotliBunbrotli4j.NETEnvoyIstioExpressKoaMicrosoft .NETPowerShellEnvoy Proxy
Organizations
CISADatadogImpervaWizELLIOTenableCanadian Centre for Cyber SecurityAikido SecurityRapid7OpenAIPrevidianJFrog
Countries
CanadaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 16d ago Rapid7 BlogFirst report

    Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)

    Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.

  2. · 16d ago The Hacker News

    PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497

    Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV