CISA Flags Critical Node2Shell (CVE-2026-111497) Brotli RCE as Exploited

Overview/Introduction

On October 28, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a Binding Operational Directive (BOD 26-04) that places a critical-severity vulnerability-dubbed Node2Shell (also known as Broccoli2Shell or HTTP2Shell)-into its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2026-111497, stems from an out-of-bounds write in the Google Brotli decoder. In the wild, threat actors are already weaponising crafted Brotli streams to achieve unauthenticated remote code execution (RCE) on a broad set of software stacks.

Technical Details (CVE, attack vector, exploitation method)

CVE-2026-111497 is classified as a critical vulnerability with a CVSS v3.1 base score of 9.8. The flaw resides in the WriteBits routine of the Brotli decoder, where the return value of a bounds-check is ignored. An attacker can supply a maliciously-crafted Brotli-compressed payload that writes beyond the allocated decoder state buffer, corrupting adjacent memory structures.

The exploitation chain looks like this:

• Step 1 - Delivery: The attacker injects a Brotli-compressed request or response into any network path that terminates at a vulnerable decoder (e.g., HTTP/2, gRPC, CDN edge, reverse proxy).
• Step 2 - Trigger: The decoder processes the payload, performs an unchecked write, and overwrites function pointers or object v-tables.
• Step 3 - Execution: Controlled data placed in the overwritten memory is interpreted as executable code, granting the attacker arbitrary code execution in the context of the vulnerable process.

The attack requires no prior authentication and works against any binary that statically links or dynamically loads the vulnerable version of the Brotli library. The flaw was first discovered in Node.js’s native Brotli support, but subsequent analysis revealed the same code path in Microsoft’s .NET implementation, the Python brotli package, Bun, Envoy, Istio, and a variety of other runtimes that rely on the reference Brotli library.

Impact Analysis (who is affected, how severe)

The breadth of affected software makes the impact exceptionally severe:

• Web servers & APIs: Node.js (v14-v20), .NET Core 6-8, Python 3.9-3.12, Bun 1.x, Envoy 1.28+, Istio 1.22+, and any custom service using the libbrotli shared library.
• Containerised workloads: Images that ship the default Brotli package (e.g., official Node, Python, and .NET containers) are vulnerable out-of-the-box.
• Edge & CDN services: Many CDN providers compress responses with Brotli; a malicious request can be reflected back to the origin, triggering the vulnerability on the origin server.
• Client-side applications: Desktop and mobile apps that decompress Brotli files (e.g., installers, update packages) are also at risk.

Exploitation leads to full system compromise: the attacker can execute arbitrary binaries, install persistence mechanisms, and move laterally within the network. Because the vulnerability is unauthenticated and network-visible, the window for detection is narrow, and traditional IDS signatures have struggled to keep pace.

Timeline of Events

• June 2026: Initial discovery of the out-of-bounds write in the Brotli reference implementation by independent security researcher.
• July 2026: Responsible disclosure to Google and major vendors (Node.js, Microsoft, Python community).
• September 2026: First public advisory released by Google, recommending library upgrades.
• October 24 2026: Threat intelligence feeds report active exploitation in the wild, targeting high-value web services.
• October 28 2026: CISA adds CVE-2026-111497 to the KEV catalog, issues BOD 26-04 requiring federal agencies to patch by November 10 2026.
• October 30 2026 (today): Microsoft publishes emergency .NET update; Node.js and Python maintainers release patched versions; multiple cloud providers publish mitigation guidance.

Mitigation/Recommendations

Given the short remediation window for federal agencies and the rapid spread of exploit kits, defenders should prioritize the following actions:

1. Apply vendor patches immediately. Updated releases include a bounds-checked decoder:
   • Node.js v20.12.0+, v18.20.0+
   • .NET 6.0.45+, .NET 8.0.12+
   • Python brotli 1.1.0+
   • Bun 1.2.3+
   • Envoy 1.28.6+, Istio 1.22.1+
2. Restart affected services. The patch only takes effect after the vulnerable process reloads the updated library.
3. Re-build container images. Pull the latest base images, verify that the Brotli package version is patched, and redeploy.
4. Deploy interim network mitigations. For environments that cannot patch within the next 48 hours, block or strip Brotli-compressed traffic at the edge firewall, reverse proxy, or API gateway. Many modern proxies (e.g., NGINX, HAProxy) allow disabling Accept-Encoding: br.
5. Enable runtime detection. Enable logging for malformed Brotli streams and monitor for sudden spikes in decoder crashes (SIGSEGV, SIGABRT). Tools like Falco or Sysdig can generate alerts on such events.
6. Conduct a rapid asset inventory. Identify all services that import libbrotli-including third-party binaries-and prioritize them for patching.

Federal agencies must complete patching by November 10, 2026 to remain compliant with BOD 26-04. Private sector organisations are strongly encouraged to meet the same timeline.

Real-World Impact (how this affects organizations/individuals)

Early threat-intel reports show that ransomware groups have incorporated the Node2Shell exploit into their initial-access kits. A compromised web server can be turned into a foothold for data exfiltration, credential dumping, and lateral movement into internal APIs, databases, and even cloud management consoles.

For SaaS providers, an exploited Brotli decoder on a public API endpoint could allow attackers to execute code in the provider’s multi-tenant environment, potentially impacting thousands of downstream customers. In the public sector, the vulnerability could affect critical infrastructure that relies on .NET-based SCADA front-ends or Node.js-driven data pipelines.

Individuals who download software or updates that are compressed with Brotli-such as game patches, firmware updates, or browser extensions-could be served malicious payloads if the installer fails to verify signatures before decompression.

Expert Opinion

From a strategic standpoint, the Node2Shell flaw underscores two broader trends:

• Compression-based attack surfaces are expanding. As HTTP/2 and HTTP/3 drive adoption of Brotli for latency reduction, the decoder becomes a high-value target. Vendors must adopt secure-by-design practices for all data-transformation libraries, not just cryptographic primitives.
• Supply-chain exposure is magnified by shared libraries. A single flaw in a widely-used open-source component can cascade across ecosystems (JavaScript, .NET, Python, Go). The community needs faster coordinated patch cycles and automated binary-level testing for such libraries.

My recommendation for security leaders is to treat compression libraries as critical assets, on par with TLS libraries. Implement continuous monitoring for decoder crashes, enforce strict content-type validation, and consider “defense-in-depth” compression strategies-such as double-checking payload signatures before decompression.

Finally, the rapid escalation from vulnerability disclosure to active exploitation demonstrates the importance of threat-intel sharing. Organizations that ingest CISA’s KEV alerts and integrate them into automated patch-management pipelines will be better positioned to mitigate this class of attacks before they translate into breach events.