CISA flags active exploitation of critical Brotli decoder flaw affecting Node.js and HTTP servers

The US Cybersecurity and Infrastructure Security Agency (CISA) announced on Tuesday that threat actors have begun actively exploiting a critical vulnerability in Brotli compression implementations. The flaw, identified as CVE-2026-111497 and also known as Node2Shell, Broccoli2Shell, and HTTP2Shell, stems from an out-of-bounds write weakness in the Brotli decoder that decompresses data encoded with Google's Brotli lossless compression algorithm.

Attackers without elevated privileges can craft malicious Brotli-compressed streams to trigger system crashes, leak memory contents, or achieve remote code execution on systems running vulnerable Brotli libraries or binaries. The vulnerability was initially discovered in the Node.js JavaScript runtime, though HTTP servers and clients using affected Brotli implementations are also at risk.

Microsoft released an emergency security update for .NET on Sunday, warning that the same vulnerability could be weaponized to escalate privileges on systems with unpatched .NET versions. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and issued a Binding Operational Directive (BOD) 26-04 requiring US federal agencies to remediate the issue by November 10, a two-week deadline.

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream

CISA

CISA further stated that "these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise." While the directive applies specifically to government agencies, CISA urged all network defenders to treat patching this flaw as a priority to prevent incoming attacks.

Organizations unable to deploy patches immediately should implement interim protections by blocking Brotli-compressed traffic at proxy or firewall boundaries, or temporarily disabling Brotli decoding functionality. Once patches are applied, administrators must restart all affected processes and rebuild and redeploy any container images that depend on the vulnerable libraries.