This flaw, identified as Node2Shell, Broccoli2Shell, and HTTP2Shell, is tracked under CVE-2026-111497. It originates from an out-of-bounds write weakness within the Brotli decoder, which is employed to expand data compressed using Google's widely used Brotli lossless compression algorithm.
Unprivileged attackers can exploit this by sending a maliciously constructed Brotli-compressed stream. This action can result in memory leaks or system crashes, and in certain scenarios, permit remote code execution on systems featuring vulnerable Brotli libraries or binaries.
The security issue was initially observed within the Node.js JavaScript runtime environment, although it also impacts HTTP servers and clients that depend on compromised Brotli implementations.
CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday, directing US government agencies to apply necessary patches within two weeks, by November 10, pursuant to Binding Operational Directive (BOD) 26-04.
CISA stated, "Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream." Furthermore, the agency noted, "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."
Although BOD 26-04 is restricted to federal entities, CISA strongly advised all network defenders to urgently patch this security weakness to mitigate incoming threats. Teams unable to implement updates immediately should block incoming Brotli-compressed requests at the proxy or firewall level, or temporarily disable Brotli decoding.
In addition to this, Microsoft issued an emergency .NET security update on Sunday, warning that attackers could use it to escalate privileges on systems running an outdated .NET version.
These vulnerabilities underscore the inherent risk associated with third-party compression libraries, where flaws in foundational components can lead to critical execution paths.
