CISA Warns of Active Attacks Exploiting Critical Node2Shell RCE Vulnerability in Node.js

CISA has added CVE-2026-111497, a critical vulnerability in Google Brotli that affects Node.js, to its Known Exploited Vulnerabilities catalog following confirmed evidence of exploitation.

Added on October 27, 2026, this flaw allows unauthenticated attackers to corrupt memory, disrupt services, disclose sensitive information, or potentially execute arbitrary code through maliciously crafted compressed streams. Federal agencies have a remediation deadline of November 10, as specified in the catalog entry.

The vulnerability is referred to as Node2Shell, HTTP2Shell, and Broccoli2Shell, and it has a CVSS score of 9.2, indicating its severity. While it is commonly associated with Node.js, the root defect lies in Google’s Brotli decoder.

The exploitability of this vulnerability depends on whether an application processes attacker-controlled compressed data through that decoder; merely running a vulnerable version of Node.js does not automatically expose an exploitable HTTP endpoint.

Node2Shell RCE Vulnerability

The defect involves malformed Brotli block switches. When a stream declares only one block type, switching types is invalid. However, vulnerable decoder helpers return the same boolean result for an invalid switch and insufficient input.

Consequently, decoding continues requesting bytes instead of rejecting the malformed stream, eventually overflowing an internal eight-byte buffer and corrupting adjacent memory.

The vulnerability combines CWE-252, unchecked return value, with CWE-787, out-of-bounds write. The upstream patch introduces a distinct error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, allowing invalid streams to terminate immediately. Google identifies affected release branches beginning with Brotli 1.0.3, with fixes available in 1.0.10, 1.1.1, and 1.2.1.

Attack paths include inbound requests carrying Content-Encoding: br, malicious responses processed through built-in fetch(), and direct node:zlib decompression. Express body-parsing middleware and Koa integrations can decompress request bodies before route handlers execute.

Unlike the separately exploited React2Shell vulnerability, this issue targets compression processing rather than React Server Components deserialization.

According to ELLIO’s technical investigation, researchers reproduced code execution against four unmodified x86-64 targets running Node.js 24.22.0, including Express, Koa, a plain HTTP application invoking decompression, and an official container. Shells inherited the service account’s privileges; the root-running container consequently produced a root shell.

On October 26, ELLIO observed a 23,069,983-byte exploitation request from 94.154.43.7, targeting the official Node.js 24.22.0 x86-64 binary.

Importantly, researchers distinguished exploitation attempts from successful compromise: the captured attacker chain failed to achieve execution across 50 laboratory attempts, although their independently validated chain obtained a shell against the same vulnerable target.

Failed attempts can still crash workers and interrupt availability. When core dumps are enabled, crashes may also preserve credentials or other sensitive process memory, creating additional exposure that requires controlled access and retention.

Administrators should install the Node.js security updates: 22.23.4, 24.22.1, or 26.12.1. Unsupported 20.x, 23.x, and 25.x installations require migration. Rebuild containers, restart services, and separately update other bundled Brotli implementations.

Temporarily rejecting inbound Brotli-encoded bodies reduces one exposure path but does not address malicious compressed responses. Verify runtime release versions rather than process.versions.brotli, because patched builds can retain the old library version string.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.