On 27 October the US agency CISA added CVE-2026-111497 to its catalogue of vulnerabilities actively exploited in attacks. This is the flaw in the decompressor of Google's Brotli library, also known as Node2Shell or HTTP2Shell, where specially crafted compressed data can cause memory leaks, crashes or code execution. Researchers' honeypots have already logged attack attempts. Fixes are available in Brotli 1.0.10, 1.1.1 and 1.2.1 and in Node.js 22.23.4, 24.22.1 and 26.12.1.

What it means: When the flaw was disclosed a few days ago, it was a serious but theoretical threat. Its listing in the CISA catalogue means real attacks are now under way, so updating moves from scheduled work to urgent work. Brotli is used to compress data on the web and sits inside many products, from Node.js servers to proxies such as Envoy and Python tools, often without the administrator knowing. That makes inventory hard: it is not enough to check whether you use the library directly, you also need to look at application dependencies and container images. For Greek teams running Node.js in production, the first step is upgrading to the fixed versions and rebuilding containers. Next, dependency analysis tools can find old Brotli versions inside other packages. Where an immediate update is not possible, consider temporarily disabling Brotli decompression for data sent by outside users, and watch more closely for unusual process crashes.

Read the original on SecurityWeek

Related service: Custom software

Related stories