Node2Shell Moves From Warning to Active Attacks as CISA Adds the Brotli Flaw to Its Exploited List
CISA has added CVE-2026-111497, the Brotli decoder flaw known as Node2Shell, to its list of vulnerabilities exploited in the wild, and honeypot operators are logging the first attack attempts. Here is what changed, what is exposed and how to decide between patching now and blocking Brotli traffic.
Last week, Node2Shell was a serious bug with patches on the way. As of Tuesday, it is a bug attackers are using. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities catalog on October 27 and told federal civilian agencies to patch by November 10.
BleepingComputer broke down CISA’s warning, and SecurityWeek gathered early evidence from honeypot operators. The summary below draws on both.
What changed this week
- Before: The flaw, also called HTTP2Shell and Broccoli2Shell, was known to be an out-of-bounds write in the Brotli decoder, the open-source compression library from Google. Specially crafted compressed data can crash a process, expose memory or, in some cases, let an attacker run code.
- Now: CISA lists it as exploited in the wild. The agency did not share details about the attacks, but it urged every organization, not just federal agencies, to make it a priority.
- Also new: Security firm Imperva has shown the flaw can be used to run code on the official Node.js container image.
Where the vulnerable code lives
Brotli versions 1.0.3 through 1.2.0 are affected, and the library is built into a long list of software. Fixes or advisories so far:
- Node.js and Google: fixes released October 21.
- Microsoft: fixes, including an emergency .NET security update on Sunday that Microsoft said could be exploited to escalate privileges.
- Bun, Envoy, Istio and two Python packages: fixes released by their maintainers.
- Palo Alto Networks: PAN-OS hotfixes are rolling out.
- Broadcom: SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected. It is rated critical (CVSS 9.8) on version 9.1.1 and important (7.5) on 9.0.x, 9.1.0 and 5.2.x. Patches are still pending, workarounds are in Broadcom’s knowledge base articles, and Broadcom did not mention any exploitation.
The evidence so far
- October 25: Threat intelligence firm ELLIO saw a public tool sending Brotli-compressed data to its sensors, apparently looking for hosts that process it.
- October 26: ELLIO logged a malicious request aimed at Node.js 24.22.0 on x86-64. The same IP address had earlier gone after the PHP2Shell flaw and probed Palo Alto Networks and Fortinet VPN devices.
- October 27: Honeypot operator Previdian recorded one exploitation attempt from a U.S. IP address. Its “confirmed” label means it is confident the request was an attack, not that the attack worked.
ELLIO said the activity points to the exploit being picked up by an operator focused on mass exploitation. There is one small piece of good news, though. ELLIO found the exploit it captured was broken, and it never produced a shell in 50 tests. ELLIO did get code execution against four setups with its own testing, though. Failed attempts can also crash the targeted process, so even a clumsy attack can knock a service offline.
Patch or block: a quick decision path
- Find it. List every server, container and appliance that runs Node.js, .NET, Bun, Envoy, Istio, PAN-OS or VMware Cloud Foundation, plus any Python apps that decompress web traffic. Ask your hosting providers and software vendors whether their products use Brotli.
- If a fix exists, apply it. Then restart the affected processes and rebuild and redeploy container images. A patched library on disk does nothing for a process or image that still runs the old one.
- If no fix exists yet, block incoming Brotli-compressed requests at your proxy or firewall, or turn off Brotli decoding in the application, until the vendor ships one.
- Then watch. Look for unexpected crashes or restarts on internet-facing services. Per ELLIO’s findings, those may be the first sign of an attempt.
What this means for your company
This is a library flaw, so you will not find it by looking for one product name. It sits inside web apps, firewalls, virtualization platforms and developer tools, and many of those were set up by vendors or contractors. If you have a website, a customer portal or a firewall facing the internet, find out this week whether any of them decode Brotli, and get written confirmation from vendors that they are patched or have a mitigation in place. Treat repeated crashes on public-facing systems as a security event, not just an annoyance.
Not sure which of your systems or vendors rely on Brotli, or whether the fixes really took effect? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
