Skip to content
CISA Flags Critical Brotli Node2Shell Flaw Amid Active Exploitation

CISA Flags Critical Brotli Node2Shell Flaw Amid Active Exploitation

First seen 29 Oct 2026, 03:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 04:08 UTC
  • •CISA added the Brotli Node2Shell flaw (CVE-2026-111497) to its KEV catalog due to active exploitation.
  • •The vulnerability affects multiple platforms, including Node.js and .NET, with patches released on October 21.
  • •Federal agencies must patch affected systems by November 10 to mitigate risks from ongoing attacks.

On October 27, CISA added CVE-2026-111497, a critical vulnerability in Google's Brotli decoder, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaw, known as Node2Shell, affects Brotli versions 1.0.3 to 1.2.0 and can lead to memory corruption, denial of service, or remote code execution. Federal agencies have until November 10 to patch their systems. The vulnerability impacts various platforms, including Node.js, .NET, Envoy, and PAN-OS, with patches already released by several vendors. Security firms have reported exploitation attempts in their honeypots, indicating the flaw is being actively targeted. Adobe Commerce's PolyShell flaw was also flagged in the same update, highlighting ongoing threats to online stores.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-14
CVE-2026-48356 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
Patches released for Brotli flaw
Node.js and Google released fixes for the Brotli decoder vulnerability, addressing critical issues.
SQ Magazine
2026-10-22
CVE-2026-111497 published
Google's Brotli decoder vulnerability was disclosed, affecting versions 1.0.3 to 1.2.0.
SQ Magazine
2026-10-27
CISA adds Brotli flaw to KEV
CISA confirmed active exploitation of the Brotli decoder flaw and added it to the KEV catalog.
SQ Magazine

More articles in this cluster (2)

Following this threat?

Track Adobe and CVE-2026-111497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

Which systems are affected by CVE-2026-111497?
The flaw affects Google’s Brotli compression library versions 1.0.3 to 1.2.0, impacting Node.js, .NET, Envoy, and PAN-OS.
What is the deadline for patching?
Federal agencies must patch their systems by November 10 to protect against active exploitation.
Is there evidence of exploitation in the wild?
Yes, security firms have reported active exploitation attempts targeting the Brotli decoder flaw.