CISA lists the OpenAI-reported Brotli flaw Node2Shell as exploited, and honeypots record attack attempts

The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-111497, a vulnerability in Google's Brotli compression library, to its Known Exploited Vulnerabilities catalog. SecurityWeek and Security Affairs report that the agency added it on October 27 alongside Adobe Commerce and Magento flaws. The bug is also known as Node2Shell, HTTP2Shell and Broccoli2Shell. It is an out-of-bounds write in the Brotli decoder affecting versions 1.0.3 through 1.2.0. With specially crafted compressed data, an attacker could crash an application, expose its memory or potentially run arbitrary code. According to SecurityWeek, OpenAI researchers reported the flaw, and Node.js and Google released fixes on October 21. Microsoft, the maintainers of two Python packages, Bun, Envoy and Istio have also shipped fixes, and Palo Alto Networks is rolling out PAN-OS hotfixes. Imperva has demonstrated code execution against an official Node.js image. CISA did not describe the attacks, but two security firms say their honeypots logged exploitation attempts, one of which used a broken exploit. Federal civilian agencies have been told to fix the flaw by a set deadline. Because Brotli is embedded so widely in web servers, proxies and runtimes, many organizations may need to update several components, not just one package.