The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed Tuesday that hackers are actively exploiting a critical vulnerability in Google's Brotli compression library, adding the flaw, tracked as CVE-2026-111497 and known as Node2Shell, to its Known Exploited Vulnerabilities (KEV) catalog and ordering federal agencies to patch within two weeks.
The flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with the widely used lossless compression algorithm. Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries.
The issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients relying on vulnerable Brotli implementations. On Sunday, Microsoft pushed an emergency .NET security update, warning that attackers could exploit it to escalate privileges on systems running a vulnerable .NET version.
CISA added the flaw to its KEV catalog on Tuesday and, under Binding Operational Directive 26-04, ordered US government agencies to patch by November 10. "Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream," CISA said. "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."
While the directive applies only to federal agencies, CISA urged all network defenders to prioritize patching. Security teams that cannot apply updates immediately should block incoming Brotli-compressed requests at the proxy or firewall level, or disable the Brotli decoding feature until they can update. After patching, administrators must also restart affected processes and rebuild and redeploy affected container images.
Analysis
Why This Matters
- The flaw is already being exploited in the wild, and because Brotli is widely used, exposure extends well beyond federal networks.
- CISA's binding directive gives US agencies a hard deadline, while its broader advisory signals that private-sector organizations face the same risk.
- Successful exploitation can range from denial of service to remote code execution, making prompt patching a priority.
Background
Brotli is a lossless compression algorithm developed by Google and broadly used to speed up web traffic. The vulnerability, CVE-2026-111497, was first identified in Node.js but affects any application relying on vulnerable Brotli implementations. CISA's Known Exploited Vulnerabilities catalog tracks flaws confirmed to be actively exploited, and Binding Operational Directive 26-04 requires federal agencies to remediate listed vulnerabilities within set timeframes. Microsoft's emergency .NET update indicates the issue also reaches into the .NET ecosystem.
Key Perspectives
- CISA: says the vulnerability "allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream," and called such flaws "a frequent attack vector for malicious cyber actors."
- Microsoft: warned that attackers could exploit the issue to escalate privileges on systems running a vulnerable .NET version.
What to Watch
- Whether federal agencies meet the November 10 patch deadline set under BOD 26-04.
- Whether additional products beyond Node.js and .NET release updates for their Brotli implementations.
- Whether exploitation expands from the initial activity CISA confirmed into broader attacks.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedCISA warned that hackers are actively exploiting a critical Brotli flaw known as Node2Shell.BleepingComputer: “On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell , Broccoli2Shell , and HTTP2Shell .”
- SupportedUS government agencies were ordered to patch the flaw by November 10, within two weeks.BleepingComputer: “CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and ordered US government agencies to patch their systems within two weeks, by November 10”
- SupportedCISA confirmed on Tuesday that hackers had begun exploiting the flaw.BleepingComputer: “On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability”
- SupportedCISA added the flaw to its Known Exploited Vulnerabilities catalog on Tuesday and ordered agencies to patch under BOD 26-04.BleepingComputer: “CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and ordered US government agencies to patch their systems within two weeks, by November 10, as mandated by its Binding Operational Directive (BOD) 26-04.”
- SupportedThe flaw is an out-of-bounds write weakness in the Brotli decoder.BleepingComputer: “this critical-severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google's widely popular Brotli lossless compression algorithm.”
- SupportedA crafted Brotli-compressed stream can cause crashes or memory leaks and, in some cases, remote code execution on devices with vulnerable Brotli libraries or binaries.BleepingComputer: “Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries.”
- SupportedThe issue was first identified in Node.js and also affects HTTP servers and clients that rely on vulnerable Brotli implementations.BleepingComputer: “The security issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.”
- SupportedMicrosoft pushed an emergency .NET security update on Sunday, warning that the flaw could be exploited to escalate privileges on systems with a vulnerable .NET version.BleepingComputer: “On Sunday, Microsoft also pushed an emergency .NET security update , warning that attackers could exploit it to escalate privileges on systems with a vulnerable .NET version.”
- SupportedThe story's first quoted statement is CISA's exact wording about the vulnerability and its potential impacts.BleepingComputer: “Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream,”
- SupportedThe story's second quoted statement is CISA's exact wording about the risks these vulnerabilities pose to the federal enterprise.BleepingComputer: “These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.”
- SupportedBOD 26-04 applies only to federal agencies, while CISA urged all network defenders to prioritize patching.BleepingComputer: “While CISA's BOD 26-04 applies only to federal agencies, the cybersecurity agency urged all network defenders to prioritize patching this security flaw to block incoming attacks.”
- SupportedTeams unable to update immediately should block incoming Brotli-compressed requests at a proxy or firewall, or disable Brotli decoding until they can update.BleepingComputer: “Security teams that can't apply the updates immediately should block incoming Brotli-compressed requests at the proxy or firewall level, or disable the Brotli decoding feature until they can update.”
