The U.S. Cybersecurity and Infrastructure Security Agency has confirmed that hackers have begun exploiting a critical flaw in Brotli, the compression library built into Node.js and a long list of other software. CISA added the vulnerability, tracked as CVE-2026-111497 and nicknamed Node2Shell, to its Known Exploited Vulnerabilities catalog this week and ordered federal civilian agencies to patch by November 10 under Binding Operational Directive 26-04.
The flaw is an out-of-bounds write in the Brotli decoder, the code that expands data compressed with Google's widely used lossless compression algorithm. Google's CVE record describes an unchecked return value that lets a remote, unauthenticated attacker corrupt adjacent decoder state memory with a crafted Brotli-compressed stream. The possible outcomes range from disclosing sensitive memory contents and crashing a service to potentially executing arbitrary code. Google rates the flaw 9.2 on the CVSS v4 scale, and it affects Brotli versions 1.0.3 through 1.2.0.
Node.js is where the bug was first identified, and it shows why a flaw in a bundled library is so hard to dodge. Node.js exposes Brotli through its zlib module and its built-in fetch function, so an application can be exposed when it decompresses data someone else controls: a compressed response fetched from an untrusted server, or a compressed request body sent to a server. Researchers have demonstrated those routes through fetch and through Express applications that decode Brotli request bodies. Node.js shipped fixes on October 21 in versions 22.23.4, 24.22.1 and 26.12.1, crediting Khai Tran and Sylvie Mayer of OpenAI Codex Security with the report. End-of-life lines such as 20.x, 23.x and 25.x will not receive a fix and need to be migrated.
The exposure does not stop with Node.js. The same decoder code travels into HTTP servers and clients, the Python Brotli packages, Bun, and other tools that bundle Brotli. On Sunday, Microsoft pushed emergency out-of-band updates for .NET 8, 9 and 10, warning that attackers could exploit the flaw to escalate privileges on systems running a vulnerable .NET version. Fixed Brotli releases are 1.0.10, 1.1.1 and 1.2.1, and every product that bundles the library needs its own update, not just the runtime at the top of the stack.
There is an honest debate about how reliable exploitation is. Threat-intelligence sensors recorded an exploitation attempt against Node.js on October 26, and researchers have separately reproduced code execution against an unmodified Node.js build, while other lab replays of a captured attack chain crashed the process repeatedly without reaching code execution. That distinction matters for triage, but not for the decision to patch: a remotely triggerable crash and memory leak in a request parser is already a serious problem, and a KEV listing means CISA has evidence of active exploitation, not just scanning.
For enterprise teams, the practical work is inventory first. Find every Node.js runtime, container image and bundled Brotli copy in the estate, including the ones hiding inside other products. Upgrade Node.js to a fixed release, update .NET and the Python packages, rebuild container images and restart services. Where a patch cannot land immediately, temporarily rejecting inbound Brotli-encoded bodies reduces one exposure path, though it does not cover malicious compressed responses. Finally, verify the runtime version itself rather than the Brotli version string the process reports, because patched builds can still display the old library version.