CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

What it is

CVE-2026-111497 (Node2Shell, also HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in the decoder of Brotli, Google's compression library. Crafted compressed data can crash the application, expose memory contents and potentially give code execution. Researchers at OpenAI reported it. Imperva has shown code execution on an official Node.js image.

Preconditions / Affected

Brotli 1.0.3 through 1.2.0 is affected. Any software that decodes attacker-supplied Brotli data is exposed, and Node.js is the main case the page documents.

Broadcom says SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected because it uses Node.js. It scores 9.8 (critical) for SDDC Manager 9.1.1 and 7.5 (important) for 9.0.x, 9.1.0 and 5.2.x. The attacker needs network access to SDDC Manager.

What to do

Fixes were released on 21 October 2026 by Node.js and Google. Microsoft, the maintainers of two Python packages, Bun, Envoy and Istio have also shipped fixes. Palo Alto Networks is rolling out PAN-OS hotfixes. The page gives no fixed version numbers, so check each vendor's advisory.

Broadcom patches are pending for all affected SDDC Manager versions. Broadcom has published workarounds in two knowledge base articles, which the page does not name. Its advisory does not mention exploitation in the wild.

CISA added the flaw to the KEV catalog on 27 October 2026 and set a deadline of 10 November for federal civilian agencies. It gave no details of the attacks.

Observed exploitation

• ELLIO's sensors caught a malicious request on 26 October aimed at Node.js 24.22.0 on x86-64. The day before, a public tool had sent Brotli-compressed data to the same sensors to find hosts that process it.
• The source IP had earlier targeted the PHP2Shell vulnerabilities and probed Palo Alto Networks and Fortinet VPN devices. ELLIO reads this as an operator focused on mass exploitation.
• Previdian recorded one attempt on 27 October from a US-based IP and rates it "confirmed". It states this does not mean the attempt succeeded.

Caveats

ELLIO found the observed exploit broken. Its delivery parts matched public proof-of-concept code, but the attacker's own final stage produced no shell in 50 tests against a vulnerable Node.js instance. ELLIO calls it a likely first-generation attempt with a defective last 12 instructions.

ELLIO itself achieved code execution against four setups running an official Node.js build on x86-64. It warns that failed attempts can crash the target process, so they can also be used for denial of service.