CISA Adds Critical Brotli Decoder Flaw Node2Shell to Exploited Vulnerabilities Catalog

CISA added CVE-2026-111497, a critical Brotli decoder memory-corruption vulnerability known as Node2Shell or HTTP2Shell, to its Known Exploited Vulnerabilities catalog on October 27. The flaw has a reported CVSS 4.0 score of 9.2 and can allow unauthenticated attackers to trigger crashes, disclose process memory, or potentially execute code through crafted compressed data. Exposure includes incoming requests and malicious responses processed by clients or backend services, often before authentication or application-level controls. Affected software includes vulnerable embedded decoder copies in Node.js, Python packages, .NET, Bun, PHP Windows builds, and some proxies and file-processing tools. Imperva reported laboratory code execution against a Node.js container, while ThreatLabz recorded 402 reconnaissance and exploitation-attempt events from 20 source IP addresses targeting 12 customers within 24 hours of disclosure. Reporting distinguished those attempts from publicly confirmed production compromises, which had not been reported at publication.

Organizations should prioritize updates across every embedded Brotli dependency, rebuild or replace affected container images, restart processes, and verify that vulnerable components are no longer running; updating a system library alone may leave bundled copies exposed. Where patching must be delayed, temporarily reject Brotli-compressed requests or disable affected decoding paths, including response processing where applicable. Defenders should correlate unusual compressed traffic with application errors, process crashes, and runtime telemetry. Published detection guidance includes Sigma, Suricata, ModSecurity, and Falco material, but the cited guide's rules were not production-validated and require independent testing. Its earlier statements that exploitation was absent and the CVE was not in CISA's catalog were superseded by subsequent reporting and the catalog addition.