CISA: Brotli Node2Shell Bug Is Now Being Exploited

The Brotli bug I wrote about last week has moved from "patch soon" to "patch now". The US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its list of flaws that attackers are actually using, which means someone out there is past the proof-of-concept stage.

What happened

On October 27, CISA put CVE-2026-111497 in its Known Exploited Vulnerabilities catalog. The bug lives in Google's Brotli decoder, the code that unpacks data compressed with the br format most websites use. The decoder doesn't check a return value properly, so a crafted stream can write past the end of a buffer. In the worst case that lets an attacker run code on a server without logging in. US federal agencies now have until November 10 to fix it.

The flaw has picked up a few names along the way: Node2Shell, Broccoli2Shell and HTTP2Shell. BleepingComputer reported the KEV listing first. CISA hasn't published details of the attacks, but Tenable's FAQ points to threat intel firm ELLIO, which said on October 26 that its sensors caught an exploit attempt aimed at Node.js 24.22.0, mixing public proof-of-concept code with a chain of its own. Tenable notes it hasn't confirmed that independently.

The list of affected software has grown too. Microsoft pushed out-of-band .NET updates on October 25: .NET 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3. The good news there is that .NET only decodes Brotli if your app has switched that on, and .NET Framework isn't affected at all.

Why it matters

A KEV listing is the line I use between "on the list" and "drop everything". It means there's evidence of real-world exploitation, not just a lab demo. And this bug is easy to be exposed to without knowing it. As I covered in my earlier post on the Brotli bug in Node, Bun and Python, fetch() in Node.js and Bun decodes br responses on its own, and Python's HTTP clients do the same if the Brotli package happens to be installed. Any code that calls out to a server you don't control could be a way in.

There's a second trap. Updating the system's libbrotli doesn't help an app that ships its own copy of the decoder, and a process that's already running keeps the old code in memory until it restarts.

What to do

• Node.js: update to 22.23.4, 24.22.1 or 26.12.1. The attempt ELLIO saw targeted 24.22.0, the release just before the fix.
• Bun: go to 1.4.4 and rebuild anything made with bun build --compile.
• Python: upgrade Brotli to 1.2.1 or brotlicffi to 1.2.1.0.
• .NET: install the runtime and SDK versions above. Self-contained and NativeAOT apps need a rebuild and redeploy.
• Linux servers and containers: install your distro's libbrotli update, then restart services and rebuild images.
• Can't patch today? CISA and BleepingComputer both suggest blocking Brotli-compressed requests at your proxy or firewall, or turning off Brotli decoding until you can update.

If you only do one thing tonight, restart whatever you patched last week. I've seen plenty of boxes where the package was updated but the service was still running the old build.