Node2Shell (CVE-2026-111497): CISA Confirms Active Exploitation of Critical Brotli RCE Flaw
In October 2026, CISA added CVE-2026-111497 — a critical remote code execution vulnerability in Google's Brotli compression library, dubbed Node2Shell — to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The flaw stems from an out-of-bounds write in the Brotli decoder, enabling unauthenticated remote attackers to corrupt decoder state memory, disclose sensitive data, cause denial-of-service, or achieve full remote code execution via a maliciously crafted compressed stream. Affected surfaces include Node.js runtimes, HTTP servers, clients, and .NET applications, prompting emergency patches from Microsoft. Federal agencies were mandated to remediate by November 10, 2026. The Node2Shell campaign underscores a persistent and accelerating trend: attackers weaponizing widely deployed open-source compression and runtime libraries to gain initial footholds at scale. As Brotli is embedded across cloud-native workloads, container images, and API gateways, the blast radius of unpatched deployments is exceptionally broad, heightening urgency for organizations operating hybrid and multicloud environments.
Kill Chain
