Attackers are already trying to exploit a flaw in Google's Brotli compression library, and U.S. federal civilian agencies have until November 10 to patch it. The bug, tracked as CVE-2026-111497, is an out-of-bounds write that crafted compressed data can trigger. Because many runtimes, web servers and appliances bundle their own copy of Brotli, the exposure reaches well beyond Google's products.
The flaw is not new. The CVE was published on October 22, and the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 27. With three days left on the federal clock, the most useful question for most IT teams is simple: do we know where Brotli runs in our stack?
Why the November 10 deadline matters
The KEV catalog lists vulnerabilities with evidence of exploitation in the wild. BOD 26-04 sets the remediation framework for federal agencies working from that list, and November 10 is the due date for federal civilian systems. Private companies are not bound by the directive, but the date gives a clear benchmark for how quickly attackers are moving.
Exploitation has already begun. Tenable's FAQ reports that threat intelligence firm ELLIO recorded an exploitation attempt on October 26, four days after the CVE was published. None of the sources reviewed for this story report how many systems were targeted or how many were compromised, so the scale of active exploitation remains unknown.
How the Brotli flaw is reached
Google's CVE record scores the flaw 9.2 under CVSS v4.0, and public proof-of-concept code is available on GitHub, according to Tenable. Vendors and researchers have not agreed on a name. Tenable uses Brotli2Shell, Trend Micro's alert uses HTTP2Shell, Aikido uses Node2Shell, and Aviatrix's analysis of Microsoft's response uses Broccoli2Shell. Searching any of those names should lead to the same CVE.
Exposure depends on what your software does with compressed data. The bug is triggered when a program decodes untrusted Brotli input. Red Hat has said that merely having Brotli installed, without decoding untrusted input, is not a practical exposure, as the Tuskira advisory summarizes. That distinction matters for triage. A library sitting in a base image is a different problem from a service that decompresses request bodies sent by strangers.
Node.js is the clearest example of how ordinary code can reach the decoder. Aikido reports that Node.js runs the decoder whenever it decompresses Brotli data, including automatically when fetch() receives a Brotli-compressed response. The same write-up says researchers demonstrated code execution on an unmodified Node.js 24.22.0 build.
Which CVE-2026-111497 fixed versions to install
Affected Google Brotli releases run from 1.0.3 through 1.2.0. The fixed builds are:
- Brotli 1.0.10
- Brotli 1.1.1
- Brotli 1.2.1
- Python users: brotli 1.2.1 and brotlicffi 1.2.1.0
Tuskira's vendor-by-vendor summary lists these builds, and Tanium's guidance covers the Python packages as well. Advisories name several products as exposed, including Node.js, Envoy, Istio, .NET 8, Python packages, PAN-OS firewalls and Linux distribution packages.
Microsoft issued out-of-band .NET updates for .NET 8, 9, 10 and 11 RC3 to address the flaw, according to Aviatrix's third-party analysis. An out-of-band update ships outside a company's normal patch schedule, which signals how seriously it treated the bug.
Sources disagree on some product details, including the Node.js version floors. Check the Node.js and Google advisories before you write version numbers into a change ticket.
Node.js timeline and the November 11 release
Node.js fixes shipped around October 21, one day before the CVE was published, according to a DEV Community walkthrough. Another Node.js security release is planned for on or shortly after November 11. It is not yet clear whether that release will change the affected-version guidance.
Key dates:
- Around October 21, 2026: Node.js fixes ship
- October 22, 2026: CVE-2026-111497 published
- October 26, 2026: ELLIO records an exploitation attempt
- October 27, 2026: CISA adds the flaw to KEV
- November 10, 2026: federal remediation deadline
- On or shortly after November 11, 2026: planned Node.js security release
One third-party vendor found no reported exploitation as of October 22. That fits the sequence above, since exploitation was logged four days after the CVE was published and CISA listed the flaw the next day.
What to do this week
Start with an inventory, because Brotli often hides where a package manager never reports it. Bundled copies, vendored libraries and container images can each carry their own version. Tanium has published guidance on finding vulnerable Brotli copies, and a scan like that is the fastest way to build a list.
Then work through the list in this order:
- Find every Brotli copy, including those inside containers and vendor appliances.
- Upgrade Node.js, .NET and Python packages to fixed builds, and rebuild images so the fix is baked in.
- Prioritize internet-facing services that decompress request or response bodies.
- Check vendor advisories for Envoy, Istio and PAN-OS before changing mesh or firewall configurations.
- Rescan after patching to confirm the fixed version is the one actually running.
- Watch for the November 11 Node.js release and repeat the rebuild when it ships.
Federal civilian teams have a hard date of November 10. Everyone else should use that date as a benchmark for how fast to move.
CentOS 7 and other legacy systems
CentOS 7 is the hard case. Aikido reports that the archived EPEL 7 package stopped at a vulnerable 1.0.9 build that will not be updated, while RHEL, Rocky Linux and AlmaLinux versions 8 through 10 shipped fixed builds. Because no fix is coming through that archived repository, teams running CentOS 7 need a replacement plan or an isolation plan. Migrating the workload to a supported operating system is the durable fix. Isolation means keeping untrusted input away from the vulnerable component until the migration is done.
The same urgency applies elsewhere. Our coverage of the WordPress flaw CVE-2026-119977 shows another vulnerability already under attack, and the C3RB3R ransomware campaign is hitting Synology NAS devices that run outdated DSM software.
What comes next
Three things will show how this plays out. The first is the November 11 Node.js release, which may change the affected-version guidance. The second is whether CISA updates the KEV entry or the deadline. The third is whether vendors or researchers publish counts of exploitation or compromise, which no source has provided yet. Until then, treat any internet-facing service that decodes Brotli from outside sources as in scope, and check the live CISA entry, since some trackers list the flaw under a different title.
