CISA reportedly adds Brotli flaw Node2Shell to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Brotli compression flaw, known as Node2Shell (CVE-2026-111497), to its Known Exploited Vulnerabilities catalog. The bug is an out-of-bounds write in the Brotli decoder used by Google's lossless compression library. It can crash applications, leak memory and, in some cases, allow an attacker to run code on systems with vulnerable versions of the library. The flaw was first identified in the Node.js JavaScript runtime, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.

Exploitation attempts recorded

Security firms have logged attempts to use the vulnerability in the wild. Previdian recorded a single exploitation attempt on October 27 from a U.S. IP address and rated its confidence as confirmed. ELLIO's sensors caught a malicious request on October 26 targeting Node.js 24.22.0 on x86-64 systems. ELLIO said the exploit was broken, and its final stage did not produce a shell in any of 50 tests, but failed attempts can still crash the targeted process. Imperva has demonstrated that the flaw can be exploited for code execution on an official Node.js image.

Patches followed the discovery. Node.js and Google released fixes on October 21, and Microsoft issued an emergency .NET update on Sunday, warning that attackers could use the flaw to escalate privileges. Fixes have also come from the maintainers of two Python packages, Bun, Envoy and Istio, while Palo Alto Networks is rolling out hotfixes for PAN-OS. Broadcom said on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected because it uses Node.js. It rates the issue critical, with a CVSS score of 9.8, for SDDC Manager 9.1.1, and patches are pending for all affected versions.

CISA added the flaw to its KEV catalog on October 27 and ordered federal agencies to patch by November 10 under Binding Operational Directive (BOD) 26-04. The agency urged all network defenders to prioritize the fix. Teams that cannot patch right away should block Brotli-compressed requests at the proxy or firewall, or disable Brotli decoding until they can update. After patching, administrators must restart affected processes and rebuild and redeploy affected container images.