Exploited in the wildCRITICALCISA KEV

Brotli decoder flaw behind Node2Shell now exploited; CISA adds to KEV

A crafted Brotli stream can corrupt memory in Google's C decoder, which Node.js, .NET, Bun and Python packages bundle. CISA added it to KEV on 2026-10-27 after honeypots logged exploit traffic. Patch runtimes, then rebuild and redeploy images.

Google Brotli C decoder (bundled in Node.js, .NET, Bun, Python Brotli, Envoy)CVE-2026-111497CVSS9.2CWE-787Libraries & supply chain
Published Oct 27, 2026 · Updated Oct 28, 2026

CISA added the CVE to KEV on 2026-10-27, citing active exploitation. ELLIO sensors logged exploit traffic on 2026-10-26, and Previdian logged one attempt on 2026-10-27. Observed activity is limited and no actor has been named.

Mar 1, 20183163 daysOct 28, 2026

What you need to know

  • Affects software that decompresses attacker-controlled Brotli data with Google's Brotli C decoder 1.0.3–1.2.0. That includes Node.js 22/24/26, .NET 8/9/10, Bun and the Python brotli/brotlicffi packages.
  • Impact ranges from a crash and memory disclosure to remote code execution. RCE has been shown on stock Node.js 24.22.0 builds, but the exploit needs per-build tuning.
  • Now exploited. CISA added it to KEV on 2026-10-27 with a federal due date of 2026-11-10. Honeypots have logged a handful of attempts since 2026-10-26, and no actor has been named.
  • Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and .NET to 8.0.33, 9.0.22 or 10.0.14. Upgrade Brotli to 1.0.10, 1.1.1 or 1.2.1. Then restart processes and rebuild images.
  • Check the Node.js release version, not process.versions.brotli, which reads 1.2.0 even on patched builds. Hunt for worker crash loops and the node2shell-check/1.0 user agent.

What's happening

CVE-2026-111497 is an out-of-bounds write in the streaming decoder (c/dec/decode.c) of Google Brotli 1.0.3 through 1.2.0 6. It is also known as Node2Shell, Broccoli2Shell, HTTP2Shell and Brotli2Shell. A crafted stream can crash the process, disclose memory or lead to code execution 9. Google scores it CVSS v4 9.2, while Node.js rates it High 9. Microsoft scores the .NET variant CVSS 3.1 8.1 as elevation of privilege and does not list code execution as an outcome 16.

Exposure follows wherever the C decoder is bundled. Node.js 22.x, 24.x and 26.x before the 2026-10-21 releases are affected, and end-of-life lines get no fix 3,7. .NET 8, 9, 10 and 11.0 previews are affected before the 2026-10-25 security updates 4. Bun, the Python Brotli and brotlicffi packages, Envoy, the Ruby gem and Debian and Alpine packages have reported fixes 7. Broadcom warned on 2026-10-27 that VMware SDDC Manager is affected through its use of Node.js, with patches pending 11. Akamai telemetry shows 61% of networks running affected Node.js versions 10.

CISA added the CVE to KEV on 2026-10-27, citing evidence of active exploitation, and set a federal due date of 2026-11-10 2,1. CISA has not described the attacks 2. On 2026-10-26, ELLIO sensors logged exploit traffic against Node.js 24.22.0 on x86-64 7,11. The traffic matched a public exploit that ELLIO had confirmed yields a shell 7. Previdian recorded one attempt on 2026-10-27 but notes this does not mean it succeeded 11,14. SecurityWeek says one logged attempt used a broken exploit 11. No actor has been named, and KEV lists ransomware use as unknown 1. The previous edition of this brief reported no in-the-wild exploitation.

How it works

The decoder treated an invalid stream condition as a temporary need for more input instead of a permanent format error 3. The streaming decoder therefore kept processing input and wrote out of bounds 3. The CVE pairs CWE-252 (unchecked return value), which Rapid7 calls the root cause, with CWE-787 (out-of-bounds write) as the result 9. Upstream commit 0ed4268a makes the affected helpers return a proper format error 7. The fix reached public google/brotli master on 2026-02-27 without a release or advisory 7. ELLIO dates the bug to Brotli 1.0.3 in March 2018 7. OpenAI Codex Security reported it to Node.js 3.

No authentication or user interaction is needed, but the application must decompress Brotli data the attacker influences 9. Node.js has three main paths to the decoder 8. Express 5, body-parser 2.x and Koa body parsers decompress inbound Content-Encoding: br request bodies 8. fetch() and other HTTP clients auto-decompress Brotli responses from attacker-controlled or compromised servers 8. Code can also call node:zlib Brotli functions directly on client data 8. A bare Node.js HTTP server does not decode Brotli request bodies on its own 8.

Reliable code execution depends on the specific Node.js build and runtime layout, and service auto-restart helps the attacker 7. Failed attempts mostly crash the worker 7. ELLIO reproduced RCE on x86-64 against four official Node.js 24.22.0 targets, with the shell running as the service account 7. The same tuning failed against 22.23.3 and 26.12.0 7. Imperva showed RCE on the official 24.22.0 Linux arm64 image after several attempts and did not release its exploit 15,7. Accounts of the public PoC differ: some reports say it reaches code execution only on a deliberately weakened build, while ELLIO says the public exploit seen in the wild gets a shell on vulnerable builds 7.

Crashes can do more than interrupt service. Where core dumps are enabled, they can write process memory, including tokens and keys, to root-readable files 7. Some bindings fail differently: Python Brotli 1.2.0, brotlicffi 1.2.0.0, PHP's streaming API and the Ruby gem hang silently, and PHP spins at 100% CPU 7. On PAN-OS, PA-Series and VM-Series firewalls are in scope only when Brotli inspection and TLS decryption are both enabled 5.

What to do

In order of priority
  1. 1

    Patch Node.js to 22.23.4, 24.22.1 or 26.12.1 or later 3. Node.js offers no supported workaround and will not fix end-of-life lines, so migrate them to a supported release 9.

  2. 2

    Install the 2026-10-25 .NET updates (8.0.33, 9.0.22, 10.0.14) and rebuild self-contained and NativeAOT apps 4. Update upstream Brotli to 1.0.10, 1.1.1 or 1.2.1 6. Apply downstream fixes for Bun, PyPI Brotli/brotlicffi, the Ruby gem, Envoy and distro packages, and rebuild bun build --compile executables 7. Every app that bundles its own Brotli copy needs its own update 7.

  3. 3

    After updating, restart affected processes and rebuild and redeploy container images 12. Updating the system Brotli library does not fix Node.js builds that bundle their own copy 13.

  4. 4

    Federal agencies must apply vendor mitigations under BOD 26-04 by 2026-11-10, or stop using the product if no mitigation is available 1.

  5. 5

    As an interim measure, drop inbound requests with Content-Encoding: br at the reverse proxy, load balancer or middleware 8. This does not cover Brotli responses your apps fetch from other servers 8.

  6. 6

    PAN-OS: disable Brotli inspection as described in Palo Alto's advisory until patched 5. VMware SDDC Manager: restrict network access until Broadcom ships patches 11.

  7. 7

    Assume breach on unpatched internet-facing services exposed since 2026-10-26. Review crash and restart logs, and look for unexpected shells running as the Node service account 7. Secure any core dumps, and rotate tokens and keys held by processes that crashed or show signs of compromise 7.

Detection

  • Inventory Node.js versions on hosts, CI runners and container images, and flag anything below 22.23.4, 24.22.1 or 26.12.1 8,3. Images pinned to old tags such as node:24.22.0 remain vulnerable 12.
  • Do not rely on process.versions.brotli. It reports 1.2.0 on both patched and unpatched Node.js builds because the fix was cherry-picked without a version bump 7.
  • Patched Node.js builds reject the malformed input with HTTP 400 and error ERR__ERROR_FORMAT_BLOCK_SWITCH (decoder error -17) 7. Search application logs for this error to spot attempts against patched hosts.
  • Treat repeated Brotli decoder crashes or Node worker restarts as both an availability and a possible disclosure incident. Where core dumps are enabled, review and restrict access to /var/lib/systemd/coredump 7.
  • Hunt web and proxy logs for the user agent Mozilla/5.0 (compatible; node2shell-check/1.0), a public checker seen from AS44620 that probes for Brotli decompression 7. Also hunt for traffic from 94.154.43[.]7, which ELLIO tied to exploit traffic 14.
  • Map reachable code paths: Express 5 or body-parser 2.x services, direct node:zlib Brotli calls on client data, and outbound fetch() calls to servers you do not control 8.
  • Outside Node.js, watch for hung Python, PHP or Ruby workers that decompress untrusted Brotli data. These bindings hang silently instead of crashing, and PHP streaming pins a CPU core 7.
  • PAN-OS: check whether Brotli inspection and TLS decryption are both enabled on the dataplane. Firewalls with both enabled are in scope 5.

Indicators

As published by the cited sources
TypeValueContext
user agentMozilla/5.0 (compatible; node2shell-check/1.0)Public exposure checker seen from AS44620; reconnaissance, not exploitation.7
ip94.154.43[.]7Netherlands-geolocated; ELLIO reports it sent CVE-2026-111497 exploit traffic and also targeted PHP2Shell flaws.14

Timeline

  1. Brotli 1.0.3, the first affected release, ships (month only, per ELLIO). 7

  2. Upstream fix committed to google/brotli master without a release or advisory. 7

  3. Node.js ships 22.23.4, 24.22.1 and 26.12.1 with the fix and publishes its advisory. 3

  4. CVE record and GitHub advisory published with CVSS v4 9.2. 6

  5. Imperva reports code execution on the official Node.js 24.22.0 arm64 image; a public PoC is also reported. 7

  6. Fixed Brotli packages become available on PyPI. 13

  7. Microsoft publishes .NET fixes 8.0.33, 9.0.22 and 10.0.14. ELLIO publishes its x86-64 RCE work and logs node2shell-check scans. 4

  8. ELLIO sensors record exploit traffic against Node.js 24.22.0 in the wild. 7

  9. CISA adds the CVE to KEV (due 2026-11-10). Previdian logs one attempt. Broadcom flags VMware SDDC Manager. 2

  10. Brief updated: status changed to exploited; KEV, .NET build numbers, IOCs and new detection guidance added.

Sources

  1. 1
    CISA KEV entry for CVE-2026-111497
    CISA · Government · Oct 27, 2026
  2. 2
    CISA Adds Two Known Exploited Vulnerabilities to Catalog
    CISA · Government · Oct 27, 2026
  3. 3
    Node.js October 21, 2026 Security Releases
    Node.js Project · Vendor · Oct 21, 2026
  4. 4
    Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write
    Microsoft · Vendor · Oct 25, 2026
  5. 5
    CVE-2026-111497 Portfolio Status
    Palo Alto Networks · Vendor
  6. 6
    GHSA-9v8h-qqgm-4m35 / CVE-2026-111497
    GitHub Advisory Database · Database · Oct 22, 2026
  7. 7
    Node2Shell (CVE-2026-111497) RCE analysis
    ELLIO · Research · Oct 25, 2026
  8. 8
    Node2Shell: Node.js Brotli vulnerability and the fix
    Aikido Security · Research · Oct 22, 2026
  9. 9
    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
    Rapid7 · Research · Oct 26, 2026
  10. 10
    Inside Node2Shell: A Closer Look at CVE-2026-111497
    Akamai · Research
  11. 11
    CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
    SecurityWeek · News · Oct 28, 2026
  12. 12
    CISA warns of hackers now exploiting critical Node2Shell flaw
    BleepingComputer · News · Oct 28, 2026
  13. 13
    Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
    BleepingComputer · News
  14. 14
    Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
    The Hacker News · News · Oct 28, 2026
  15. 15
    Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
    The Hacker News · News
  16. 16
    Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
    SecurityWeek · News

Corroborated by independent sources. Researched and drafted by the VulnDigest briefs agent from 16 sources, then checked against them by a separate review step on Oct 28, 2026.

Exploitation rests on CISA KEV (2026-10-27, no attack details) plus ELLIO and Previdian honeypot hits. Microsoft has not confirmed exploitation and rates it Exploitation More Likely.

Real-world RCE is disputed. ELLIO and Imperva showed it on stock Node.js 24.22.0 builds, but it needs per-build tuning; some researchers consider the bug DoS-only in practice.

Fixed versions for Bun, PyPI Brotli/brotlicffi, the Ruby gem, Envoy, Debian and Alpine come from ELLIO, not each vendor's advisory. VMware SDDC Manager patches were pending as of 2026-10-27.

The 9.2 score is CVSS v4.0 from Google. Node.js rates the bug High, and Microsoft scores the .NET variant CVSS 3.1 8.1 (elevation of privilege). KEV and GitHub list it as Unchecked Return Value (CWE-252).

PAN-OS scope and workaround could not be rechecked against Palo Alto's current advisory; confirm versions and steps there before acting.

ELLIO says it first saw the node2shell-check scanner's address on 2026-06-13, before disclosure. This is unexplained and is not treated as the first exploitation date.

Spotted an error? Open an issue on sochub.io.