Vulnerabilities · Threat Intelligence
Critical Brotli flaw (Node2Shell) is being exploited, CISA warns
A severe vulnerability in Google's Brotli compression library is under active attack. Exploitation attempts have been logged, and patches are available for many affected products.
Ross Grant3 min read
The short version
A serious bug has been found in Brotli, a tool used by many popular apps and services to compress data. Attackers are already trying to exploit this flaw to break into systems or crash them. Updates are available for many affected products, but not all. If you manage servers or software, check if you use Brotli and update as soon as possible.
By the numbers
- 9.8CVSS score for SDDC Manager 9.1.1 (critical)SecurityWeek
- 7.5CVSS score for SDDC Manager 9.0.x, 9.1.0, 5.2.x (important)SecurityWeek
- November 10Deadline for US federal agencies to address the flawSecurityWeek
What happened?
A critical vulnerability in Google's Brotli compression library (CVE-2026-111497) is being actively targeted. Security firms have logged real-world exploitation attempts against honeypots. Patches are available for many affected products, but some fixes are still pending. CISA has added the flaw to its Known Exploited Vulnerabilities catalogue and instructed US federal agencies to address it.
How the flaw works
The Node2Shell vulnerability (CVE-2026-111497) is a critical bug in the Brotli data compression library, which was developed by Google. The flaw is an out-of-bounds write in the Brotli decoder. This means that when Brotli processes specially crafted compressed data, it can write data outside the area it's supposed to, leading to memory corruption. Attackers can use this to crash applications, read sensitive information from memory, or even run their own code on the affected system. This type of bug is often called a buffer overflow.
The vulnerability affects Brotli versions 1.0.3 through 1.2.0. Many popular products use Brotli for data compression, so the impact is wide.
Who is affected
Any software using vulnerable versions of Brotli could be at risk. This includes Node.js (versions up to 24.22.0), Google products, Microsoft software, Python packages, Bun, Envoy, Istio, and Palo Alto Networks' PAN-OS. Broadcom has warned that its SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected, especially version 9.1.1, which it rates as critical (CVSS 9.8). Other versions are rated important (CVSS 7.5).
How the attack worked
Security firms Previdian and ELLIO both saw real-world attempts to exploit this vulnerability. Previdian logged an attack attempt on October 27 from a US-based IP address, targeting their honeypots (systems set up to attract and study attacks). ELLIO saw a similar attempt a day earlier, aimed at Node.js 24.22.0 on x86-64 systems. The exploit used was based on public proof-of-concept code, but ELLIO found that the final stage of the attack did not succeed in gaining a shell (remote command access) in their tests. This suggests attackers are still refining their methods, but the attempts are happening in the wild.
Even failed attacks can crash the targeted application, leading to denial-of-service (DoS) conditions. Successful exploitation could allow attackers to run code of their choice on the system.
The response
CISA (the US Cybersecurity and Infrastructure Security Agency) added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalogue on October 27. Federal agencies have been told to address the flaw by November 10. Node.js and Google released fixes on October 21. Other vendors, including Microsoft, maintainers of key Python packages, Bun, Envoy, Istio, and Palo Alto Networks, have also released or are rolling out patches. Broadcom has published workarounds for affected VMware products while patches are pending.
Security researchers recommend identifying any use of vulnerable Brotli versions and updating as soon as possible. Organisations should review their environments for affected products and apply patches or workarounds.
Is there a fix?
Yes. Updates are available for Brotli itself and for many affected products. Some vendors are still rolling out fixes or providing temporary workarounds. Check with your software suppliers for the latest updates and apply them promptly.
Claimed vs confirmed
- Unconfirmed
Attackers have achieved remote code execution in the wild using this flaw.
Security firms have observed exploitation attempts, but ELLIO found the exploit used did not succeed in their tests.
Why it matters
This vulnerability affects a core library used in many widely deployed products. Attackers are already trying to exploit it, which increases the risk for organisations that have not yet patched. Even failed attacks can cause outages.
Key points
- Node2Shell (CVE-2026-111497) is a critical bug in Google's Brotli library.
- Attackers are actively trying to exploit the flaw, according to security firms.
- Many popular products are affected, including Node.js and VMware SDDC Manager.
- Patches are available for some products; others have workarounds or pending fixes.
- Even failed attacks can crash systems, causing denial-of-service.
Sources
SecurityWeek
Reference
Sophos
Reference
