Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

CISA Adds Node2Shell Brotli Decoder Flaw to KEV Catalog

1 source · 2 articlesFirst reported Updated ()2
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added Node2Shell (CVE-2026-111497) in Google's Brotli decoder to its Known Exploited Vulnerabilities catalog on October 27, 2026, after confirmed exploitation.

CISA added CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder that can corrupt memory, leak data, crash applications or enable remote code execution, to its Known Exploited Vulnerabilities catalog on October 27. Node.js disclosed the flaw on October 21 with fixes in versions 22.23.4, 24.22.1 and 26.12.1, while Brotli 1.0.10, 1.1.1 and 1.2.1 contain fixes. End-of-life Node.js 20.x, 23.x and 25.x receive no updates. Proof-of-concept exploits and honeypot logs show active exploitation; federal agencies must remediate by November 10. Many projects bundle vulnerable Brotli including .NET, Bun, Python, Envoy and Istio. CISA recommends patching or disabling Brotli decoding.

Key facts
  • CVE-2026-111497 out-of-bounds write in Brotli decoder
  • Node.js fixes: 22.23.4, 24.22.1, 26.12.1 (October 21)
  • Brotli fixes: 1.0.10, 1.1.1, 1.2.1
  • CISA KEV added October 27; federal deadline November 10
  • EOL Node.js 20.x, 23.x, 25.x not fixed
  • Exploitation confirmed in honeypots and wild traffic
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Node.js discloses and patches CVE-2026-111497 · Tenable Blog, Help Net Security, SecurityWeek
  2. Oct 22, 2026NVD publishes CVE-2026-111497 record · Tenable Blog
  3. Oct 27, 2026CISA adds Node2Shell to KEV catalog · Multiple reports including CISA
  4. Oct 28, 2026Canadian Centre issues AL26-027 advisory · Canadian Centre for Cyber Security
  5. Oct 29, 2026Datadog reproduces PoC on Node.js 24.22.0 · Datadog Security Labs
  6. Oct 30, 2026Patchstack details WordPress XML-RPC exposure · Patchstack

What each outlet adds

beyond the shared facts
  • Tenable BlogFAQ lists affected runtimes including .NET, FFmpeg and ClickHouse; rates CVSS 9.2
  • Help Net SecurityReports ELLIO honeypot traffic from IP linked to prior attacks
  • SecurityWeekDetails CISA honeypot logs and confirmed exploitation attempts
  • BleepingComputerCovers CISA exploitation confirmation and Microsoft .NET privilege escalation update
  • PatchstackDetails WordPress exposure via libcurl on XML-RPC and other routes
CVEs
CVE-2026-111497
Vendors
GoogleNode.jsMicrosoftBroadcomPalo Alto Networks
Products
Node.jsBrotliBunbrotli4j.NETEnvoyIstioExpressKoaMicrosoft .NETPowerShellEnvoy Proxy
Organizations
CISADatadogImpervaWizELLIOTenableCanadian Centre for Cyber SecurityAikido SecurityRapid7OpenAIPrevidianJFrog
Countries
CanadaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 16d ago Cyber Security NewsFirst report

    Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497

    The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.

  2. · 16d ago Cyber Security News

    Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws

    Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV