Vulnerability named Node2Shell exploited in attacks

A critical security flaw, known as CVE-2026-111497 and nicknamed Node2Shell or Broccoli2Shell, has been actively exploited in real-world attacks, even after patches were made available for Node.js and .NET. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its list of Known Exploited Vulnerabilities (KEV), confirming that malicious actors have successfully used it.

Patches released but attacks continue

Patches for the vulnerability were released on October 21 by the Node.js development team and the Brotli compression library developers. Just four days later, Microsoft issued emergency updates for .NET. The flaw affects multiple versions of Brotli across all platforms, including versions 1.0.3 to 1.0.9, 1.1.0, and 1.2.0.

High severity rating assigned to the flaw

Google’s security team has assigned a CVSS score of 9.2 out of 10 to the vulnerability, which indicates a critical level of severity. The flaw allows attackers to manipulate an application’s memory when decompressing data, potentially leading to crashes, exposure of sensitive information, or even remote code execution.

Remote code execution demonstrated in tests

Researchers from the cybersecurity firm Imperva previously showed that it is possible to execute arbitrary code on a vulnerable Node.js server in a controlled test environment. However, CISA has not disclosed details about the real-world attacks, including the identities of the attackers, the systems targeted, or the number of affected users.

Vulnerability affects multiple software environments

The flaw is not limited to JavaScript environments. The vulnerable Brotli decoder is also used in .NET, Bun, Envoy, Istio, and some Python libraries. The risk applies to any application that decompresses data controlled by an attacker, whether through incoming server requests or outgoing HTTP client responses. Using Brotli compression for web pages does not automatically make a service vulnerable.

CISA urges mitigation steps for affected systems

CISA recommends that administrators review the components used in their applications, restart affected processes, and rebuild container images that include vulnerable versions of Brotli. In the meantime, the agency advises blocking the decompression of Brotli content from untrusted sources to reduce the risk of exploitation.