Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA lists exploited Brotli Node2Shell flaw; agencies due November 10

10 sources · 10 articlesFirst reported Updated ()1
What's new

October 30: Patchstack says stock WordPress does not ship Brotli, but libcurl can unpack malicious pingback replies and crash PHP workers.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA lists CVE-2026-111497 as exploited; agencies must remediate by November 10, and vendor fixes are available.

CISA listed CVE-2026-111497, a Brotli decoder out-of-bounds write also called Node2Shell, Broccoli2Shell, and HTTP2Shell, as known exploited on October 27, 2026. US civilian agencies must fix it by November 10. Crafted compressed streams can crash processes, leak memory, or potentially run code in Node.js, .NET, Python packages, Bun, Envoy, Istio, and other clients that decode Content-Encoding: br. Fixes published October 21 include Brotli 1.0.10, 1.1.1, and 1.2.1, and Node.js 22.23.4, 24.22.1, and 26.12.1; unsupported Node.js 20.x, 23.x, and 25.x have none. SecurityWeek says ELLIO’s observed payload failed to spawn a shell, while GBHackers says ELLIO reproduced shells on Node.js 24.22.0.

Key facts
  • Affected Brotli spans 1.0.3 through 1.2.0; fixes are 1.0.10, 1.1.1, and 1.2.1.
  • Patched Node.js releases are 22.23.4, 24.22.1, and 26.12.1; EOL branches stay vulnerable.
  • Most outlets score the flaw 9.2; Broadcom rates SDDC Manager 9.1.1 at 9.8, patches pending.
  • Previdian logged one October 27 attempt from a US IP and calls exploitation confirmed.
  • Patched Node.js can still report process.versions.brotli as 1.2.0.
  • Public WordPress tooling is described as denial of service, not a PHP code-execution chain.
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Node.js and Google released fixes for the Brotli flaw · SecurityWeek
  2. Oct 22, 2026A public proof of concept appeared · Datadog Security Labs
  3. Oct 26, 2026ELLIO observed a request against Node.js 24.22.0 · SecurityWeek
  4. Oct 27, 2026CISA added CVE-2026-111497 to the KEV catalog · Cyber Security News
  5. Oct 28, 2026Canada’s Cyber Centre warned about Broccoli2Shell · Canadian Centre for Cyber Security
  6. Oct 30, 2026Patchstack described WordPress exposure through libcurl · Patchstack

What each outlet adds

beyond the shared facts
  • SecurityWeekHoneypot attempts and unpatched Broadcom SDDC Manager
  • Zscaler ThreatLabzMissed block-decode check; inbound bodies and outbound responses
  • Datadog Security LabsPublic PoC date and Brotli version string still 1.2.0
  • GBHackersClaims ELLIO reproduced shells; failed large request details
  • PatchstackWordPress pingback crash path without shipping Brotli
CVEs
CVE-2026-111497CVE-2026-105482CVE-2026-102870
Vendors
GoogleNode.jsMicrosoftBroadcomPalo Alto NetworksCiscoCanonical
Products
Node.jsBrotliBunbrotli4j.NETEnvoyIstioExpressKoaMicrosoft .NETPowerShellEnvoy Proxy
Organizations
CISADatadogImpervaWizELLIOTenableCanadian Centre for Cyber SecurityOpenAIPrevidianZscaler ThreatLabz
Countries
CanadaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 3d ago SecurityWeekFirst report

    CISA lists Brotli Node2Shell flaw as honeypots log attempts

    CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.

  2. · 2d ago BleepingComputer

    CISA confirms exploitation of critical Brotli flaw CVE-2026-111497

    Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.

  3. · 2d ago Cyber Security News

    CISA lists exploited Node2Shell flaw CVE-2026-111497

    Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.

  4. · 2d ago Canadian Centre for Cyber Security

    CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited

    Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.

  5. · 2d ago Zscaler ThreatLabz

    Brotli flaw CVE-2026-111497 may allow RCE via crafted streams

    A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.

  6. · 2d ago Cisco Security Advisories

    Cisco warns October 2026 Node.js flaws can enable RCE

    High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.

  7. · 2d ago Datadog Security Labs

    Brotli decoder flaw CVE-2026-111497 exploited across many runtimes

    CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.

  8. · 2d ago GBHackers

    CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497

    Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.

  9. · 1d ago Ubuntu Security Notices

    Ubuntu fixes .NET debug-proxy and Brotli flaws

    The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.

  10. · 1d ago Patchstack

    Stock WordPress pingback can crash workers via Brotli CVE-2026-111497

    WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-102870
Code injection in ASP.NET Core allows remote code execution
8.8—
CVE-2026-105482
NUL-byte truncation in Node.js dns.resolve* and dns.reverse
7.4<1%PoC ×2
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV