Key Takeaways
- CISA added CVE-2026-111497, a flaw in Google's Brotli compression library also called HTTP2Shell, Node2Shell, and Broccoli2Shell, to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, based on evidence of active exploitation.
- According to CISA, CVE-2026-111497 lets a remote attacker who does not need to log in use crafted Brotli-compressed data to expose memory, crash a program, or potentially run code. Google gives CVE-2026-111497 a critical score of 9.2 out of 10, while Node.js rates it high.
- Fixed versions for CVE-2026-111497 include Brotli 1.0.10, 1.1.1, and 1.2.1 and Node.js 22.23.4, 24.22.1, and 26.12.1. Microsoft released emergency .NET updates for CVE-2026-111497, and Rapid7 lists Bun, Envoy, Istio, and Python packages among other affected software.
- U.S. federal civilian agencies must fix CVE-2026-111497 by November 10, 2026, under CISA's Binding Operational Directive 26-04, and CISA encourages all organizations to prioritize flaws in the KEV catalog.
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, a Google Brotli flaw also known as HTTP2Shell, Node2Shell, and Broccoli2Shell, to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026. The KEV catalog lists flaws that attackers are known to use. CISA said in its alert that it added the flaw based on evidence of active exploitation.
Brotli, an open-source compression library that Google develops and maintains, shrinks files so they can be transmitted faster, according to BleepingComputer.
According to CISA, the flaw lets a remote attacker who does not need to log in send specially crafted Brotli-compressed data. That data can corrupt memory, expose sensitive memory contents, crash the program, or potentially let the attacker run code.
As BleepingComputer reported, the flaw has several names because it was first found in Node.js, before researchers saw that the same flaw could affect software in several other ecosystems. Node.js is a JavaScript runtime environment used to run server software.
Google, which assigned the CVE identifier, gives the flaw a critical score of 9.2 out of 10, while Node.js rates it high, according to Rapid7.
Timeline
| Date (2026) | Event |
|---|---|
| October 21 | Google releases Brotli 1.2.1 and Node.js releases fixed versions |
| October 22 | Public disclosure, according to BleepingComputer |
| October 26 | BleepingComputer reports public proof-of-concept code but no attacks in the wild |
| October 27 | CISA adds the flaw to the KEV catalog |
| November 10 | Deadline for U.S. federal civilian agencies |
A proof of concept is code that shows a flaw can be exploited. Researchers at Imperva's red team demonstrated that the flaw could be exploited, according to Wiz.
Who is affected
Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 are affected, BleepingComputer reported. Google fixed the flaw in Brotli 1.2.1. Brotli 1.0.10 and 1.1.1 also contain the fix.
The Node.js advisory lists the 26.x, 24.x, and 22.x release lines as affected, with fixes in Node.js 22.23.4, 24.22.1, and 26.12.1. The project states that end-of-life versions are always affected when a security release occurs.
Rapid7 lists other affected implementations, including Bun, Python's brotli and brotlicffi packages, .NET, Envoy and Istio, Brotli4j, and operating-system packages. Python web clients such as requests, httpx, and aiohttp can be affected when set up with a vulnerable Brotli decoder, according to BleepingComputer.
For .NET, Microsoft said Brotli decompression is not enabled by default, and applications must opt in to it, according to BleepingComputer's report on the .NET update. Microsoft released out-of-band updates, issued outside its regular schedule, for .NET 8, .NET 9, and .NET 10, along with a .NET 11 release candidate.
Wiz reported that, according to its data, 91% of cloud environments have resources vulnerable to the flaw. Rapid7 said a system with an affected decoder is exposed only if an application on it processes Brotli data supplied by an attacker.
Response
Node.js credited Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting the flaw.
CISA ordered U.S. federal civilian agencies to fix the flaw by November 10, 2026, under Binding Operational Directive (BOD) 26-04, BleepingComputer reported. The directive applies only to those agencies, but CISA encourages all organizations to prioritize flaws in the KEV catalog.
CISA's alert does not name who is exploiting the flaw. The same alert added a second exploited flaw, CVE-2026-48356 in Adobe Commerce and Magento.
What organizations should do
Rapid7 recommends that organizations running an affected Node.js release upgrade urgently, outside normal patch cycles. It said Node.js has not published a workaround.
BleepingComputer reported that after updating, administrators must restart affected processes and rebuild and redeploy affected container images. A website tracking the flaw warns that updating the system Brotli library does not fix Node.js or other applications that bundle their own copy, according to BleepingComputer.
For teams that cannot update right away, BleepingComputer reported advice to block incoming Brotli-compressed requests at the proxy or firewall, or to disable Brotli decoding until the update is applied. The same tracking site warns that blocking incoming requests still leaves applications exposed through compressed responses they receive.