--- type: "post" id: "cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4" slug: "cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4" title: "CISA adds Brotli flaw CVE-2026-111497 (Node2Shell) to KEV as honeypots log first in-the-wild exploit attempts" description: "CISA has added the Brotli decoder vulnerability CVE-2026-111497, also called Node2Shell, to its Known Exploited Vulnerabilities catalog." retrieval_nugget: "CISA has added the Brotli decoder vulnerability CVE-2026-111497, also called Node2Shell, to its Known Exploited Vulnerabilities catalog." published_at: "2026-10-28" updated_at: "2026-10-28" record_date: "2026-10-28" date_kind: "published_at" topics: ["google"] entities: ["CISA","Brotli","Node2Shell","Node.js","OpenAI","Broadcom","VMware Cloud Foundation","ELLIO"] related_patterns: [] novelty_label: "new_fact" what_changed: "CISA added CVE-2026-111497 to KEV with a November 10 federal remediation deadline, while honeypots reported new exploitation attempts." prior_refs: ["memory:7d323280-7bea-858b-a67e-e81be0c917f4","memory:2ec195eb-13e9-8ae3-a850-d1c3b4f6ccaf"] source_url: "https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts" source_urls: ["https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts"] schema_version: "newruntime-agent-readable-v0.2" stable_id: "post:cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4" status: "published" visuals: [] editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]} routes: {"html":"https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4/","markdown":"https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4.md","json":"https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4.json"} --- # CISA adds Brotli flaw CVE-2026-111497 (Node2Shell) to KEV as honeypots log first in-the-wild exploit attempts ## Retrieval answer CISA has added the Brotli decoder vulnerability CVE-2026-111497, also called Node2Shell, to its Known Exploited Vulnerabilities catalog. ## Summary CISA has added the Brotli decoder vulnerability CVE-2026-111497, also called Node2Shell, to its Known Exploited Vulnerabilities catalog. Reports of attempted exploitation turn a dependency-patching issue into an immediate inventory and remediation task for teams whose services accept Brotli-compressed input. ## What happened CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27. The vulnerability is known by several names, including Node2Shell, HTTP2Shell, and Broccoli2Shell. It is an out-of-bounds write in the decoder of Brotli, Google's data-compression library. SecurityWeek reports that the affected range is Brotli versions 1.0.3 through 1.2.0. The risk is tied to processing specially crafted compressed data. According to the report, an attacker could crash an application, expose memory contents, and potentially execute arbitrary code. Researchers at OpenAI reported the bug. Node.js and Google released fixes on October 21, and fixes have also been released by Microsoft, the maintainers of two Python packages, Bun, Envoy, and Istio. Palo Alto Networks is rolling out PAN-OS hotfixes. Imperva has demonstrated code execution against an official Node.js image. CISA did not provide details of the attacks behind its KEV listing, but two security firms separately reported activity in their sensors. Previdian recorded one exploitation attempt on October 27 from a US-based IP address and rated its confidence that the event was exploitation as confirmed. It also stressed that this confidence concerns the evidence for an attempt, not whether the attempt succeeded. ELLIO reported a malicious request aimed at Node.js 24.22.0 on x86-64 on October 26. A publicly available tool had probed its sensors the previous day by sending Brotli-compressed data to identify hosts that process it. ELLIO said the attacking IP had previously targeted PHP2Shell vulnerabilities and probed Palo Alto Networks and Fortinet VPN devices. Its analysis found that the delivery components resembled public proof-of-concept code, but the attacker's last stage did not produce a shell in 50 tests against a vulnerable Node.js instance. ELLIO nevertheless achieved code execution on four setups using an official Node.js build on x86-64, and noted that failed attempts can still crash a process and be used for denial of service. Broadcom also warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected through its use of Node.js. It assigned a critical 9.8 CVSS score to SDDC Manager 9.1.1 and an important 7.5 score to versions 9.0.x, 9.1.0, and 5.2.x. Patches are pending for all affected VMware versions; Broadcom has published workarounds. ## What the archive adds This is a new fact on a known story: the earlier disclosure and fixed Brotli releases were covered in [OpenAI's red-team agents found an unauthenticated RCE in the Brotli compression library](https://newruntime.com/posts/openai-s-red-team-agents-found-an-unauthenticated-7fb79e/) and [OpenAI's Patch the Planet discloses Brotli decoder RCE](https://newruntime.com/posts/openai-s-patch-the-planet-discloses-brotli-decoder-ad9480/). The new material is the KEV listing, reported exploit attempts, and the VMware exposure status. ## Trend signal No supplied New Runtime pattern genuinely fits this dependency-security event without extending the evidence beyond what the source establishes. ## Why now The timeline has compressed quickly. Node.js and Google released fixes on October 21; ELLIO observed a public probing tool on October 25 and a malicious request the next day; CISA added the flaw to KEV on October 27. The public availability of proof-of-concept-like delivery components and reported sensor activity make delayed dependency inventory materially riskier. ## Connections to other events The archive records that CISA added PHP2Shell flaws to KEV on October 27 in [CISA adds PHP2Shell flaws to the Known Exploited Vulnerabilities catalog](https://newruntime.com/posts/cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05/). ELLIO says the IP observed in this Node2Shell attempt had previously targeted PHP2Shell, though that observation does not establish attribution or a common operator. ## Why it matters AI builders frequently operate services that combine application runtimes, gateways, proxies, package managers, and managed infrastructure. Brotli can enter that chain indirectly: through an application runtime, a proxy layer, an embedded native component, or a vendor product that uses Node.js. The operational question is therefore not merely whether a repository directly declares Brotli. It is which internet-reachable components decode untrusted Brotli data, what version they embed, and whether an upstream fix has reached the deployed artifact. KEV status and reported attempts justify treating this as an exposure-management incident. The source also gives an important nuance: observed attacks were not all successful. That does not reduce the urgency of patching, because a failed chain can still crash a service and public exploit components lower the cost of further attempts. ## What happens next - **More vendors will identify affected embedded Brotli or Node.js components.** (3 months, 75%). Watch for: product advisories and fixed-image releases. - **Public exploit attempts will continue to target exposed Brotli-processing services.** (3 months, 70%). Watch for: additional sensor reports or CISA updates. ## Limits and uncertainty The source reports attempted exploitation, not confirmed compromise of a victim environment. Previdian explicitly distinguishes evidence of an attempt from evidence that it succeeded. ELLIO found the final stage of the observed attack broken in its tests, although it independently demonstrated code execution in four official Node.js setups. The report does not provide a complete list of affected products, configuration prerequisites for every deployment, or a universal method to discover embedded Brotli copies. It also does not say that every service using Node.js, Bun, Envoy, Istio, or VMware software is exposed. ## Skill to build now Create a short incident inventory rather than relying on a top-level dependency scan. List public-facing services that accept compressed requests or responses, then map their runtime image, proxy, gateway, and vendor appliance versions. Compare each to the vendor's fixed release or workaround, prioritize externally reachable decoders, and test both patch deployment and rollback. Record where compression is terminated so ownership is clear between application and platform teams. ## Reader takeaway Node2Shell is no longer only a newly disclosed Brotli flaw: CISA has placed it in KEV and sensors have recorded exploit attempts. Patch known affected releases, but also search the deployment chain for products that embed the vulnerable decoder or use Node.js underneath. ## Open question Which deployed products in a team's externally reachable path process attacker-controlled Brotli data through embedded or transitive components? Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json ## Continue in the graph Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`. - topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub. - collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis. - collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph. - whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)