# Brotli2Shell Is Being Exploited and Its Federal Deadline Is November 10

- URL: https://usa-24.com/cve-2026-111497-brotli-flaw-exploited/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-08T00:13:40.700Z
- Updated: 2026-11-08T00:13:40.705Z
- Topics: Brotli Vulnerability, Node.js Security, Known Exploited Vulnerabilities, Patch Management, Remote Code Execution

> Google's Brotli decoder flaw is under active exploitation, and the U.S. federal remediation deadline is November 10. Node.js, .NET and Python users should check their stacks now.

## Key takeaways

- CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a federal due date of November 10.
- Affected Google Brotli releases run from 1.0.3 through 1.2.0, and the fixed builds are 1.0.10, 1.1.1 and 1.2.1.
- Google's CVE record scores the flaw 9.2 under CVSS v4.0, and public proof-of-concept code is available on GitHub.
- Node.js runs the Brotli decoder automatically when fetch() receives a Brotli-compressed response, and another Node.js security release is planned for on or shortly after November 11.
- CentOS 7's archived EPEL package stopped at the vulnerable 1.0.9 build and will not be updated, so that system needs a replacement or isolation plan.

Attackers are already trying to exploit a flaw in Google's Brotli compression library, and U.S. federal civilian agencies have until November 10 to patch it. The bug, tracked as CVE-2026-111497, is an out-of-bounds write that crafted compressed data can trigger. Because many runtimes, web servers and appliances bundle their own copy of Brotli, the exposure reaches well beyond Google's products.

The flaw is not new. The CVE was published on October 22, and the Cybersecurity and Infrastructure Security Agency (CISA) added it to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on October 27. With three days left on the federal clock, the most useful question for most IT teams is simple: do we know where Brotli runs in our stack?

## Why the November 10 deadline matters

The KEV catalog lists vulnerabilities with evidence of exploitation in the wild. BOD 26-04 sets the remediation framework for federal agencies working from that list, and November 10 is the due date for federal civilian systems. Private companies are not bound by the directive, but the date gives a clear benchmark for how quickly attackers are moving.

Exploitation has already begun. [Tenable's FAQ](https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497) reports that threat intelligence firm ELLIO recorded an exploitation attempt on October 26, four days after the CVE was published. None of the sources reviewed for this story report how many systems were targeted or how many were compromised, so the scale of active exploitation remains unknown.

## How the Brotli flaw is reached

Google's CVE record scores the flaw 9.2 under CVSS v4.0, and public proof-of-concept code is available on GitHub, according to Tenable. Vendors and researchers have not agreed on a name. Tenable uses Brotli2Shell, [Trend Micro's alert](https://success.trendmicro.com/en-US/solution/KA-0024830) uses HTTP2Shell, [Aikido](https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497) uses Node2Shell, and [Aviatrix's analysis](https://aviatrix.ai/threat-research-center/microsoft-net-emergency-patch-brotli-cve-2026-111497-broccoli2shell/) of Microsoft's response uses Broccoli2Shell. Searching any of those names should lead to the same CVE.

Exposure depends on what your software does with compressed data. The bug is triggered when a program decodes untrusted Brotli input. Red Hat has said that merely having Brotli installed, without decoding untrusted input, is not a practical exposure, as the [Tuskira advisory](https://www.tuskira.ai/advisories/cve-2026-111497) summarizes. That distinction matters for triage. A library sitting in a base image is a different problem from a service that decompresses request bodies sent by strangers.

Node.js is the clearest example of how ordinary code can reach the decoder. Aikido reports that Node.js runs the decoder whenever it decompresses Brotli data, including automatically when fetch() receives a Brotli-compressed response. The same write-up says researchers demonstrated code execution on an unmodified Node.js 24.22.0 build.

## Which CVE-2026-111497 fixed versions to install

Affected Google Brotli releases run from 1.0.3 through 1.2.0. The fixed builds are:

- Brotli 1.0.10
- Brotli 1.1.1
- Brotli 1.2.1
- Python users: brotli 1.2.1 and brotlicffi 1.2.1.0

Tuskira's vendor-by-vendor summary lists these builds, and [Tanium's guidance](https://www.tanium.com/blog/http2shell-find-and-fix-vulnerable-brotli-copies-with-tanium) covers the Python packages as well. Advisories name several products as exposed, including Node.js, Envoy, Istio, .NET 8, Python packages, PAN-OS firewalls and Linux distribution packages.

Microsoft issued out-of-band .NET updates for .NET 8, 9, 10 and 11 RC3 to address the flaw, according to Aviatrix's third-party analysis. An out-of-band update ships outside a company's normal patch schedule, which signals how seriously it treated the bug.

Sources disagree on some product details, including the Node.js version floors. Check the Node.js and Google advisories before you write version numbers into a change ticket.

## Node.js timeline and the November 11 release

Node.js fixes shipped around October 21, one day before the CVE was published, according to a [DEV Community walkthrough](https://dev.to/hassann/is-your-nodejs-version-vulnerable-to-the-brotli-rce-check-in-2-minutes-6a9). Another Node.js security release is planned for on or shortly after November 11. It is not yet clear whether that release will change the affected-version guidance.

Key dates:

- Around October 21, 2026: Node.js fixes ship
- October 22, 2026: CVE-2026-111497 published
- October 26, 2026: ELLIO records an exploitation attempt
- October 27, 2026: CISA adds the flaw to KEV
- November 10, 2026: federal remediation deadline
- On or shortly after November 11, 2026: planned Node.js security release

One third-party vendor found no reported exploitation as of October 22. That fits the sequence above, since exploitation was logged four days after the CVE was published and CISA listed the flaw the next day.

## What to do this week

Start with an inventory, because Brotli often hides where a package manager never reports it. Bundled copies, vendored libraries and container images can each carry their own version. Tanium has published guidance on finding vulnerable Brotli copies, and a scan like that is the fastest way to build a list.

Then work through the list in this order:

1. Find every Brotli copy, including those inside containers and vendor appliances.
2. Upgrade Node.js, .NET and Python packages to fixed builds, and rebuild images so the fix is baked in.
3. Prioritize internet-facing services that decompress request or response bodies.
4. Check vendor advisories for Envoy, Istio and PAN-OS before changing mesh or firewall configurations.
5. Rescan after patching to confirm the fixed version is the one actually running.
6. Watch for the November 11 Node.js release and repeat the rebuild when it ships.

Federal civilian teams have a hard date of November 10. Everyone else should use that date as a benchmark for how fast to move.

## CentOS 7 and other legacy systems

CentOS 7 is the hard case. Aikido reports that the archived EPEL 7 package stopped at a vulnerable 1.0.9 build that will not be updated, while RHEL, Rocky Linux and AlmaLinux versions 8 through 10 shipped fixed builds. Because no fix is coming through that archived repository, teams running CentOS 7 need a replacement plan or an isolation plan. Migrating the workload to a supported operating system is the durable fix. Isolation means keeping untrusted input away from the vulnerable component until the migration is done.

The same urgency applies elsewhere. Our coverage of [the WordPress flaw CVE-2026-119977](https://usa-24.com/wordpress-cve-2026-119977-under-attack/) shows another vulnerability already under attack, and [the C3RB3R ransomware campaign](https://usa-24.com/synology-ransomware-c3rb3r-dsm-update/) is hitting Synology NAS devices that run outdated DSM software.

## What comes next

Three things will show how this plays out. The first is the November 11 Node.js release, which may change the affected-version guidance. The second is whether CISA updates the KEV entry or the deadline. The third is whether vendors or researchers publish counts of exploitation or compromise, which no source has provided yet. Until then, treat any internet-facing service that decodes Brotli from outside sources as in scope, and check the live CISA entry, since some trackers list the flaw under a different title.

## Frequently asked questions

### Is CVE-2026-111497 being exploited in the wild?

Yes. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27, 2026, and threat intelligence firm ELLIO recorded an exploitation attempt on October 26, according to Tenable. No source reviewed reports how many systems were targeted or compromised.

### What is the federal deadline for CVE-2026-111497?

Federal civilian agencies must remediate the flaw by November 10, 2026, under BOD 26-04. Private organizations are not bound by that directive, but the date is a useful benchmark for patching urgency.

### Which Brotli versions fix CVE-2026-111497?

The affected range is Google Brotli 1.0.3 through 1.2.0. Fixed builds are 1.0.10, 1.1.1 and 1.2.1, and Python users should move to brotli 1.2.1 and brotlicffi 1.2.1.0. Check the Node.js and Google advisories before publishing exact version numbers.

### Am I exposed if Brotli is installed on my server?

Exposure depends on decoding untrusted Brotli data, not just having the library present. Red Hat has said that merely having Brotli installed, without decoding untrusted input, is not a practical exposure, according to Tuskira's advisory.

### What should CentOS 7 users do about this flaw?

The archived EPEL 7 package stopped at vulnerable version 1.0.9 and will not be updated. Teams should replace the system with a supported operating system or isolate the affected component from untrusted input.

## Sources

1. [Brotli2Shell: Google Brotli decoder (CVE-2026-111497) FAQ, Tenable](https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497)
2. [SECURITY ALERT: HTTP2Shell — Critical Brotli RCE (CVE-2026-111497), Trend Micro](https://success.trendmicro.com/en-US/solution/KA-0024830)
3. [HTTP2Shell: Find and Fix Vulnerable Brotli Copies with Tanium, Tanium](https://www.tanium.com/blog/http2shell-find-and-fix-vulnerable-brotli-copies-with-tanium)
4. [CVE-2026-111497: Brotli flaw on CISA KEV, fixed versions by vendor, Tuskira](https://www.tuskira.ai/advisories/cve-2026-111497)
5. [Is Your Node.js Version Vulnerable to the Brotli RCE? Check in 2 Minutes, DEV Community](https://dev.to/hassann/is-your-nodejs-version-vulnerable-to-the-brotli-rce-check-in-2-minutes-6a9)
6. [Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix, Aikido](https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497)
7. [CVE-2026-111497 Broccoli2Shell: Microsoft Emergency .NET Brotli Patch Analysis, Aviatrix](https://aviatrix.ai/threat-research-center/microsoft-net-emergency-patch-brotli-cve-2026-111497-broccoli2shell/)
8. [Known Exploited Vulnerabilities Catalog, CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)