Brotli exists to make web traffic smaller and faster, and it's very good at its job. Unfortunately, a bug in its decoder also hands attackers a way in, and CISA says they're using it.

From Squeezed Bytes to Shells

CISA added CVE-2026-111497, nicknamed Node2Shell (also Broccoli2Shell and HTTP2Shell, because one name is never enough), to its Known Exploited Vulnerabilities catalog on October 27. The flaw is an out-of-bounds write in the decoder of Google's Brotli compression library. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak data, crash the service, or potentially run code. Federal civilian agencies have until November 10 to patch.

The bug was first identified in Node.js, which bundles its own copy of Brotli. Node.js shipped fixes on October 21, but end-of-life release lines won't get patches. Microsoft pushed an emergency .NET update on October 25, and researchers have flagged other software built on vulnerable Brotli code, including Bun, Envoy Proxy, Istio and some Python HTTP clients.

The Dependency You Never Chose

Most teams never decided to run Brotli. It came bundled with their runtime, so it never appeared on their own dependency list. A routine npm audit checks your packages, not the C library compiled into the Node.js binary running in production. That's how bugs like this sit unpatched long after the fix ships.

Reports on real-world exploitation are mixed. Public proof-of-concept code exists and honeypots have logged attempts, but researchers say getting full code execution can take several tries against some targets. That's not a reason to wait. Patch, then restart affected processes and rebuild your container images, because a fix doesn't reach a process that's still running or an image you built last month. If you can't patch yet, block incoming Brotli-compressed requests at the proxy or firewall, or turn off Brotli decoding until you can.

Your web server's compression settings are now part of your security setup.

Node2Shell is a textbook case of an inherited dependency causing trouble, and our free developer security checklist walks through finding the components you're running without realizing it.

Source: BleepingComputer