Security Advisory

CISA Confirms Active Exploitation of a Critical Compression-Library Flaw Reaching Far Beyond Node.js

October 28, 2026 · Cyber One Solutions Security Team

CISA added CVE-2026-111497, a critical out-of-bounds write in the widely embedded Brotli compression library, to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10 remediation date. Nicknamed "Node2Shell," the flaw sits inside Node.js, many .NET applications, and a long list of other software that decompresses data from the internet. Here is what it is, who it reaches, and what to patch now.

On October 27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, described in its catalog as the "Google Brotli Unchecked Return Value Vulnerability," to its Known Exploited Vulnerabilities (KEV) catalog, with a November 10, 2026 remediation due date. CISA's required action directs stakeholders to "[a]pply mitigations in accordance with vendor instructions," in line with Binding Operational Directive 26-04, which sets that due date for U.S. federal civilian agencies rather than private businesses, per CISA's Known Exploited Vulnerabilities catalog entry for CVE-2026-111497. CISA only adds a flaw to that catalog when it has evidence attackers are already using it, so this listing confirms active exploitation, not a theoretical risk. What makes this one worth your attention even if you have never heard of Brotli: the flawed code is not one product, it is a small decompression library that countless other pieces of software, including some you may run without knowing it, have copied into themselves.

What Brotli Is, and Why One Library Touches So Much

Brotli is a compression format Google published in 2015 that web servers, browsers, and applications use to shrink data moving over the internet, similar in purpose to the older gzip format. Because it is free and fast, software vendors across the industry embed Google's reference Brotli code directly inside their own products rather than writing their own compressor. That is efficient for vendors, but it means a single flaw in Google's original code can quietly exist inside dozens of unrelated products that have each copied it in. The National Institute of Standards and Technology's National Vulnerability Database (NVD) record for the flaw shows it affects the Brotli decoder's C source code in file c/dec/decode.c, versions 1.0.3 through 1.2.0, and NVD gives it a CVSS 3.1 base score of 9.8, Critical, under vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, tracked under two weakness classes, CWE-252 (Unchecked Return Value) and CWE-787 (Out-of-Bounds Write), per NIST's NVD record for CVE-2026-111497. Google, as the issue's assigning authority, separately rates it 9.2, also Critical, under the newer CVSS 4.0 standard. In plain terms, both scores describe the same thing: no account or password is needed (PR:N), no action from a victim is needed (UI:N), and the flaw is reachable over the network (AV:N). Google's fix is in Brotli versions 1.0.10, 1.1.1, and 1.2.1.

The flaw itself, as Node.js's own security advisory explains it, is a logic error in how the decoder handles a malformed compressed stream: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer," per Node.js's October 2026 security release advisory. That mistake lets a specially crafted compressed file keep writing past the end of a small internal buffer, corrupting memory the program did not intend to touch. Node.js credits security researchers Khai Tran and Sylvie Mayer with reporting the flaw, and Node.js maintainers Matteo Collina and Antoine du Hamel with fixing it.

Why It Is Called "Node2Shell," and Why That Name Undersells It

Security researchers nicknamed this flaw "Node2Shell" because Node.js, the JavaScript runtime that powers a large share of the web's custom backend applications and APIs, bundles the vulnerable Brotli code and is affected across its 22.x, 24.x, and 26.x release lines. Node.js's fixed versions are 22.23.4, 24.22.1, and 26.12.1; the already end-of-life 20.x, 23.x, and 25.x lines will not receive a fix at all, which means any business still running one of those unsupported lines needs a full upgrade to a supported major version, not just a patch. But multiple researchers and vendors have confirmed the same underlying Brotli bug reaches well past Node.js. Microsoft's own advisory for its .NET runtime describes a buffer overflow in its bundled Brotli decoder that "may allow an unauthenticated attacker to read or corrupt process memory," rating it 8.1, High, under a different CVSS 3.1 vector than NVD's Node.js-focused score, which is a reminder that the same root flaw can carry a different real-world severity depending on how each product exposes it, per Microsoft's .NET runtime security advisory for CVE-2026-111497. Google also shipped fixed releases of its Python Brotli bindings. Security researchers tracking the issue have additionally flagged other software that bundles Brotli decompression as worth checking, among them curl, the Envoy and Istio proxy software many businesses run behind the scenes in cloud infrastructure, and various media and data-processing libraries, though, as endpoint-security firm Rapid7 cautions, simply having the Brotli code present does not mean a given product is exposed; what matters is whether that product actually decompresses Brotli-formatted data that comes from outside your organization's control.

Active Exploitation

CISA's KEV listing is itself the clearest evidence this is being exploited now, but independent researchers describe what that looks like. Threat intelligence firm ELLIO reported observing exploit traffic in the wild from an internet address with a prior history of scanning for unrelated VPN and Kubernetes flaws, which it reads as a sign of broad, automated scanning rather than a single targeted attack. Proof-of-concept exploit code is publicly available, and security firm Imperva reported it was able to reproduce remote code execution against Node.js's own official container image for the affected version. None of this means every business is a target today, but it does mean the barrier to exploiting an unpatched, internet-facing system is now low.

Who Is Affected

This reaches any business running custom web applications, APIs, or backend services built on Node.js, whether developed in-house, by a contractor, or by a software vendor, if that Node.js version has not yet been updated to 22.23.4, 24.22.1, or 26.12.1. It also reaches businesses running .NET-based applications or other software your IT provider or vendor has not yet confirmed is patched for this specific CVE. If your business relies on custom software, a web application, or an API that a developer, agency, or vendor built and now maintains for you, rather than a product in a box, this is exactly the kind of embedded, hard-to-see dependency that needs a direct answer from whoever maintains it: not "we are keeping things updated" in general, but confirmation that this specific Brotli-linked flaw has been checked and closed.

What to Do Now

Ask whoever manages your custom websites, web applications, or backend/API services, in-house staff, a developer, an agency, or your IT provider, whether any of them run on Node.js, and if so, whether that Node.js installation has been updated to 22.23.4, 24.22.1, or 26.12.1 or later.
If any system is still on Node.js 20.x, 23.x, or 25.x, those lines are end of life and will not get a fix for this flaw; plan an upgrade to a currently supported major version rather than waiting on a patch that is not coming.
Ask about any .NET-based applications or services as well, and request confirmation they have applied Microsoft's fix for this CVE.
A version-number update alone is not enough if the affected software runs in a container or prebuilt server image: confirm that container images and deployed artifacts were actually rebuilt and redeployed with the patched Brotli code, not just that a dependency file was edited.
Prioritize anything internet-facing, a public website, a customer-facing API, or any service that accepts files or data from outside your organization, since that is where this flaw is reachable by an attacker.
If a service shows unexplained crashes, restarts, or memory errors in the time since this flaw became public, treat that as a possible sign of attempted or successful exploitation worth investigating rather than dismissing as a routine glitch.

Why This Belongs on Your Radar

Most small and mid-size businesses do not write their own compression code, and most will never have heard of Brotli before this week, which is exactly the point: a flaw in a small, widely copied library can sit quietly inside software your business depends on without your developer, agency, or IT provider having specifically flagged it before now. This is the nature of modern software: almost every application is built from dozens or hundreds of smaller components other people wrote, and a single flaw in one of them can surface in products that have nothing else in common. That is also why asking "are we patched" is not enough on its own; the useful question is "which of our systems actually contain this library, and has each one specifically been checked." Keep a dated record of that check, since an auditor or insurer may later ask how you track known, actively exploited vulnerabilities in the software your business depends on, including components your own staff did not write and may not know by name.

For businesses subject to the FTC Safeguards Rule or the HIPAA Security Rule, the same obligations we have flagged for earlier advisories apply here. The FTC Safeguards Rule requires nonbanking financial institutions to maintain a documented information security program that includes vulnerability monitoring under 16 CFR 314.4(d)(2), though institutions maintaining customer information on fewer than 5,000 consumers are exempt from that paragraph. HHS Office for Civil Rights guidance treats identifying and remediating known, actively exploited vulnerabilities as part of the ongoing risk analysis and risk management obligations at 45 CFR 164.308(a)(1)(ii)(A) and (B); for a covered entity or business associate, a web application or API that creates, receives, maintains, or transmits ePHI falls within that scope even when the vulnerable component is a dependency rather than code your own team wrote.

Cyber One Solutions' managed cybersecurity service includes tracking vendor advisories like this one against the software our managed clients actually run, so a flaw like this gets checked against your real environment rather than left for you to notice on your own. If you are not sure whether your custom web applications, APIs, or the servers behind them have ever been inventoried for exactly this kind of embedded dependency, our IT and security assessments can tell you what is actually running and whether this fix is in place.