Organizations using vulnerable Brotli decoding software face an actively exploited flaw that can expose memory, disrupt services or potentially allow remote code execution. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-111497, also known as Node2Shell, to its Known Exploited Vulnerabilities catalog on October 27, 2026.
CISA’s alert establishes that exploitation has occurred, but gives no attack start date, victim details or account of what attackers achieved. It identifies the issue as an unchecked return value vulnerability in Google Brotli.
The exposure extends beyond Node.js, where the flaw was first identified, according to BleepingComputer’s October 28 report. HTTP servers and clients are also affected when they depend on vulnerable Brotli implementations. The critical-severity vulnerability is additionally called Broccoli2Shell and HTTP2Shell.
Brotli compresses data without losing information; decoding restores that data for use. BleepingComputer describes an out-of-bounds write in the decoder, meaning a write can reach beyond its intended memory area. In CISA’s description quoted by the publication, a remote attacker needs no authentication to submit a crafted Brotli-compressed stream that can corrupt adjacent decoder state memory. Possible outcomes include disclosure of sensitive memory, denial of service and arbitrary code execution. The confirmation of active exploitation does not establish which of those outcomes occurred in the observed attacks.
The same report says Microsoft issued an emergency .NET security update on Sunday, warning of possible privilege escalation on systems running a vulnerable .NET version.
Remediation and temporary measures
BleepingComputer reports a November 10 remediation deadline for federal agencies. CISA specifies that Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. Its alert describes a requirement to prioritize high-risk cataloged vulnerabilities on publicly exposed assets where exploitation grants total control, and expectations for checking whether compromise preceded patching. CISA also encourages other organizations to prioritize remediation of cataloged vulnerabilities.
For systems that cannot yet be updated, BleepingComputer recommends temporarily disabling Brotli decoding or blocking incoming Brotli-compressed requests at a proxy or firewall. Its guidance also calls for restarting affected processes after installing updates and rebuilding and redeploying affected container images.
