CISA Adds Critical Flaw to Exploited Catalog
On October 27, 2026, the Cybersecurity and Infrastructure Security Agency (Cybersecurity News) added a critical out-of-bounds write vulnerability, tracked as CVE-2026-111497 and widely known as Node2Shell, to its Known Exploited Vulnerabilities catalog. The flaw resides in Google’s Brotli compression library versions 1.0.3 through 1.2.0. Federal agencies and enterprise server operators face a mandatory patching deadline of November 10, 2026, following the detection of live exploit traffic targeting Node.js infrastructure.
Google’s Common Vulnerability Scoring System (Cybersecurity News) rates the bug as a 9.2 Critical severity issue under CVSS 4.0. According to security researchers, an unauthenticated remote attacker can supply a specially crafted Brotli stream to corrupt memory, leak sensitive data, trigger application crashes, or execute arbitrary remote code with the privileges of the running service account.
Technical Mechanics of the Brotli Decoder Defect
The vulnerability originates from an unchecked return value in a Brotli decoder helper function that improperly mishandles invalid block switches. When a compressed Brotli stream declares an invalid block type configuration, the decoder helper returns a plain false value—the exact same indicator used when a legitimate stream simply runs out of input bytes.
When the calling application receives this indicator, it feeds more data into the decoder. However, while a genuine input shortage drains an internal eight-byte buffer, an invalid block switch leaves that buffer intact. As additional data arrives, unhandled bytes accumulate and eventually overflow the buffer past the eighth byte. Because the write operation relies on a signed 32-bit offset, an attacker can manipulate memory pointers to write data into arbitrary locations, facilitating remote code execution.
Widespread Ecosystem Impact and Attack Vectors
The flaw’s reach extends far beyond bare Node.js environments. Node.js versions 22.x, 24.x, and 26.x are directly affected, alongside end-of-life lines such as 20.x, 23.x, and 25.x which will receive no vendor patches. Fixed releases include Node.js 22.23.4, 24.22.1, and 26.12.1. Other affected software includes Bun prior to version 1.4.4, Python Brotli and brotlicffi packages, Envoy, the Ruby brotli gem, and various Linux distribution packages.
Servers become vulnerable whenever they automatically unpack inbound or outbound Brotli-encoded payloads. Common exposure paths include HTTP frameworks like Express 5 and Koa with body-parser packages, built-in JavaScript fetch operations, and direct node:zlib utility calls processing client-supplied data.
Observed Scanning and Active Exploitation in the Wild
Security sensors detected initial reconnaissance scans on October 26, 2026, when an automated checker launched probing requests to identify servers capable of decompressing Brotli traffic. Actual exploit payloads followed shortly afterward from an IP address previously associated with scanning campaigns targeting other framework flaws.
Security analysts note that failed exploitation attempts often crash worker processes rather than successfully establishing shells. On stock Linux hosts, these crashes can generate core memory dumps containing sensitive session cookies, tokens, and cryptographic keys from other users, magnifying the security risk for unpatched deployments.
Immediate Mitigation and Patching Guidance
Administrators must urgently update upstream dependencies, rebuild container images, and refresh package lockfiles. A critical administrative trap involves Node.js builds that have cherry-picked security fixes without updating their visible version strings; systems administrators must verify exact release numbers rather than relying on internal version queries. Until complete patching can be verified across all environments, teams are advised to restrict or inspect untrusted Content-Encoding headers.