CISA Adds Node2Shell Brotli Flaw to KEV After Exploitation
First merged summary.
CISA added Node2Shell (CVE-2026-111497) to KEV on October 27 after confirmed exploitation and public PoC.
CISA added CVE-2026-111497, also known as Node2Shell, Broccoli2Shell and HTTP2Shell, to its Known Exploited Vulnerabilities catalog on October 27, 2026. The out-of-bounds write in the Google Brotli decoder can corrupt adjacent memory, leak data, crash processes or enable code execution from crafted compressed streams. Node.js, Google and multiple other projects released fixes on October 21, 2026. Federal civilian agencies must remediate by November 10, 2026. Exploitation is confirmed with live traffic and public proof-of-concept code.
- CISA added CVE-2026-111497 to KEV on October 27, 2026
- Federal agencies must fix by November 10, 2026
- Node.js fixed versions: 22.23.4, 24.22.1, 26.12.1
- Brotli fixed versions: 1.0.10, 1.1.1, 1.2.1
- CVSS score 9.2; affects Node.js and HTTP stacks
- Public PoC appeared October 22; lab reproductions confirm shells
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js and Google release Brotli decoder fixes · Multiple outlets
- Oct 26, 2026Exploit attempt logged against Node.js 24.22.0 · ELLIO
- Oct 27, 2026CISA adds CVE-2026-111497 to KEV catalog · CISA
- Oct 28, 2026Canadian Centre issues AL26-027 Brotli alert · Canadian Centre for Cyber Security
- Oct 29, 2026Datadog reproduces Node2Shell on Node.js · Datadog Security Labs
- Oct 30, 2026Patchstack warns of WordPress exposure via libcurl · Patchstack
What each outlet adds
beyond the shared facts- SecurityWeekHoneypot logs one October 27 attempt from US IP; rates exploitation as confirmed
- Canadian Centre for Cyber SecuritySpecific alert AL26-027 with exact affected Brotli ranges and recommended mitigations
- Datadog Security LabsReproduction details on Node.js 24.22.0 and patched builds still reporting version 1.2.0
- PatchstackWordPress exposure via unauthenticated pingbacks and libcurl unpacking
- GBHackersPublic exploit payload analysis and shell reproduction on Node.js 24.22.0
Coverage
oldest first · one row per article · UTC- · 7d ago
The Hacker NewsFirst report
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
- · 7d ago
GBHackers
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
- · 7d ago
Cyber Security News
Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |