CISA has added CVE-2026-111497, the Brotli decoder vulnerability dubbed Node2Shell, to its Known Exploited Vulnerabilities catalog after security researchers observed attack attempts in honeypot environments. The catalog entry identifies active exploitation and sets a Nov. 10 remediation deadline for organizations covered by CISA guidance.
The flaw is an out-of-bounds write in Brotli’s decoder, a component used to decompress data in Node.js and other software. According to the Node.js security advisory, malformed Brotli input can cause the streaming decoder to append data beyond an internal buffer. The resulting memory corruption can crash a process, disclose memory contents or, under the right conditions, enable remote code execution by an unauthenticated attacker.
The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0 across platforms. The National Vulnerability Database records a CVSS 4.0 score of 9.2, rated critical, with network reachability, no privileges required and high impact to confidentiality, integrity and availability. NVD has not assigned a CVSS 3.1 score and continues to mark the record as undergoing analysis.
Node.js fixed its bundled copy in versions 22.23.4, 24.22.1 and 26.12.1, released through the project’s Oct. 21 security update. The upstream Brotli fixes are versions 1.0.10, 1.1.1 and 1.2.1. Updating an operating system’s Brotli package alone may not protect Node.js deployments or applications that ship their own embedded copy of the decoder.
Honeypot operators reported seeing exploit traffic shortly after public proof-of-concept material became available, although at least one observed attempt was malformed and failed. Those observations establish scanning and attempted exploitation, but do not by themselves demonstrate successful compromise or identify a responsible threat actor. CISA’s KEV designation nevertheless means defenders should treat internet-exposed systems that process attacker-controlled Brotli data as an active-priority patching issue.
Administrators should inventory Node.js runtimes and applications that consume Brotli-compressed request bodies, responses or streams, upgrade to the fixed release for each supported branch, and check logs for unusual compressed-input requests and process crashes. Where immediate patching is not possible, reducing exposure to untrusted Brotli data and applying vendor mitigations can limit risk, but the durable fix is to replace affected libraries or runtimes.
