The United States Cybersecurity and Infrastructure Security Agency (CISA) has recently included the Node2Shell vulnerability in its Known Exploited Vulnerabilities (KEV) catalog. This flaw, officially tracked as CVE-2026-111497 and also known by the names HTTP2Shell and Broccoli2Shell, has been a target for exploitation attempts according to reports from two security firms monitoring honeypot activities.
Understanding the Node2Shell Vulnerability
The Node2Shell vulnerability is an out-of-bounds write issue found in the Brotli data compression library, which was developed by Google. It specifically affects Brotli versions from 1.0.3 to 1.2.0. An attacker leveraging this flaw can potentially crash the application, access the system’s memory, or execute arbitrary code by utilizing specially crafted compressed data.
OpenAI researchers first reported this bug, prompting fixes from Node.js and Google on October 21. Furthermore, companies like Microsoft, Bun, Envoy, and Istio have released patches, while Palo Alto Networks is deploying hotfixes for PAN-OS systems. Security firm Imperva has demonstrated successful code execution using this vulnerability on an official Node.js image.
Active Exploitation Attempts
On October 27, CISA updated its KEV catalog to include CVE-2026-111497, urging federal civilian agencies to address the flaw by November 10. While CISA did not provide details on specific attacks, security firm Previdian reported an exploitation attempt from a U.S.-based IP address on the same day. The firm confirmed the attempt’s authenticity but clarified that confirmation does not guarantee successful exploitation.
Another cybersecurity lab, ELLIO, documented a malicious request targeting Node.js 24.22.0 on x86-64 systems on October 26. This attempt utilized Brotli-compressed data, indicating an operator’s interest in mass exploitation. However, ELLIO’s tests revealed that the exploit was incomplete, failing to achieve the intended results in their analysis.
Impact and Mitigation Steps
The Node2Shell vulnerability raises significant concerns, especially for systems like VMware’s SDDC Manager. Broadcom, responsible for the software, has reported that versions 9.1.1 and earlier are vulnerable, assigning a high severity level to these issues. Patches are currently pending, but Broadcom has issued workarounds to mitigate risks in the interim.
As the cybersecurity community continues to address this vulnerability, agencies and organizations are advised to apply patches promptly and monitor for any suspicious activity. The Node2Shell flaw highlights the ongoing challenges of maintaining secure systems in the face of sophisticated cyber threats.
