The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-111497, known as Node2Shell, to its Known Exploited Vulnerabilities catalogue, giving federal civilian agencies until 10 November 2026 to remediate. The flaw is an out-of-bounds write in Google's Brotli decoder, affecting Brotli versions 1.0.3 to 1.2.0, where crafted compressed data can crash an application, leak memory, or potentially allow code execution. Google rates it 9.2 out of 10 under CVSS version 4.0.

A critical Brotli flaw, now listed

Fixes landed on 21 October 2026 from Node.js and Google: fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1, and fixed Brotli versions are 1.0.10, 1.1.1 and 1.2.1. Evidence of real-world probing is already appearing in sensors. SecurityWeek reports two firms recorded attempts: Previdian logged one attempt on 27 October from a US-based IP address, and ELLIO recorded a malicious request against Node.js 24.22.0 on 26 October. Broadcom warned on 27 October that VMware SDDC Manager is affected, with patches pending.

Attempts logged — but no victim named

What the evidence does not show matters as much as what it does. CISA published no attacker, victim or evidence details and lists ransomware use as unknown, and ELLIO says the attempt it observed in the wild failed to obtain a shell in 50 tests, even though it separately achieved code execution in its own lab on official Node.js builds. An attempt is not proof of a successful compromise, and no named victim is claimed here. Organisations using Brotli should patch and hunt, not assume the patch alone closes the incident.

Sources: SecurityWeek and Sophos.