The US cybersecurity agency CISA has added the Brotli vulnerability known as Node2Shell to its Known Exploited Vulnerabilities (KEV) catalog. Separately, two security firms say they have recorded exploitation attempts against their honeypots.
Tracked as CVE-2026-111497 and also known as HTTP2Shell and Broccoli2Shell, the flaw is an out-of-bounds write in the decoder of Brotli, the data compression library developed by Google.
It impacts Brotli versions 1.0.3 through 1.2.0. With specially crafted compressed data, an attacker could crash the application, expose the contents of its memory, and potentially execute arbitrary code.
The bug was reported by researchers at OpenAI, and Node.js and Google released fixes on October 21. Microsoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.
Imperva has demonstrated that the vulnerability can be exploited for code execution on an official Node.js image.
CISA added CVE-2026-111497 to the KEV catalog on October 27, but provided no information on the attacks. Federal civilian agencies have been instructed to address the flaw by November 10.
Previdian, which monitors exploitation activity through its own network of sensors, says it recorded one exploitation attempt targeting CVE-2026-111497 on October 27, coming from a US-based IP address. The company rates its confidence in the exploitation as ‘confirmed’.
“Confidence is how strongly the evidence supports treating this as exploitation of this vulnerability. It does not mean the attempt succeeded,” Previdian explains.
ELLIO, a cybersecurity lab that monitors reconnaissance and mass exploitation activity, says its sensors caught a malicious request targeting Node.js 24.22.0 running on x86-64 systems on October 26. The previous day, a publicly available tool had sent Brotli-compressed data to its sensors to determine which hosts process such data.
The exploitation attempt came from an IP address that ELLIO previously saw targeting the PHP2Shell vulnerabilities and probing Palo Alto Networks and Fortinet VPN devices. “This is indicative of the RCE being adopted by an operator focused on mass exploitation,” ELLIO said.
According to ELLIO’s analysis, however, the exploit used in the attack was broken. Its delivery components matched public proof-of-concept code, but the final stage, which the attacker wrote themselves, did not result in a shell in any of the 50 tests ELLIO ran against a vulnerable Node.js instance.
“This was likely a first-generation attempt fired in the wild before the operator fully tested the final stage against a live target – a working framework with a defective last 12 instructions,” ELLIO noted.
The company has itself achieved code execution against four different setups running an official Node.js build on x86-64. It also warns that failed exploitation attempts can crash the targeted process, which means they can be used in denial-of-service (DoS) attacks.
VMware patches pending
Broadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected by CVE-2026-111497 because it uses Node.js.
The company rates the issue critical, with a CVSS score of 9.8, for SDDC Manager 9.1.1. For versions 9.0.x, 9.1.0 and 5.2.x, it rates the bug important, with a CVSS score of 7.5.
“A malicious actor with network access to SDDC Manager may exploit this issue to execute arbitrary code,” Broadcom said.
Patches are pending for all affected versions, and Broadcom has published workarounds in two knowledge base articles. Its advisory does not mention exploitation in the wild.
Related: Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Related: HPE Patches Dozens of Critical Flaws in Networking Products
Related: This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Related: Industrial Vendors Check Products for PHP2Shell Vulnerabilities
