# CISA Adds Node2Shell Brotli Flaw to KEV as Node.js Patch Gap Persists

- URL: https://usa-24.com/node2shell-vulnerability-nodejs-brotli/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-29T20:01:30.420Z
- Updated: 2026-10-29T20:01:30.430Z
- Topics: Node2Shell, Node.js Security, Brotli Vulnerability, CISA Known Exploited Vulnerabilities, Patch Management

> CISA put the Node.js Brotli flaw CVE-2026-111497 on its Known Exploited Vulnerabilities list on October 27. Federal agencies have until November 10, and many Linux and Node.js builds still lack fixes.

## Key takeaways

- CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, with a November 10, 2026 remediation deadline for federal civilian agencies.
- The Node.js project fixed the flaw on October 21 in releases 22.23.4, 24.22.1 and 26.12.1, while Node.js 20.x and older, 23.x and 25.x are end-of-life with no fix.
- The bug is an out-of-bounds write in Google's Brotli decoder, which Google scores 9.2 (Critical) under CVSS v4.0 while Node.js rates its advisory High.
- Patching Node.js does not fix separately bundled Brotli copies, so Linux packages, Python libraries and .NET apps need their own updates.
- As of October 26, SUSE and standard Red Hat Enterprise Linux repositories had no fix, according to Aikido, while Debian, Alpine and Amazon Linux had patches.

The U.S. government now has a clock running on one of the more widespread bugs in the Node.js ecosystem. On October 27, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog and set November 10 as the remediation deadline for federal agencies, according to [GBHackers](https://gbhackers.com/cisa-warns-node2shell-rce-vulnerability-in-node-js/). The Node2Shell vulnerability, also tracked as HTTP2Shell and Broccoli2Shell, sits in Google's Brotli decoder, a compression component that Node.js bundles. That means the flaw can reach any software that decompresses Brotli data, not only Node.js applications.

The listing matters well beyond federal offices. The KEV catalog tracks flaws with evidence of active exploitation, so an addition signals that attacks have moved past theory. Private companies face no federal deadline, but many US developers run Node.js behind web apps, APIs and webhook handlers, and any public service that accepts compressed requests can be targeted.

Researchers at [ELLIO Threat Research Lab](https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/) say exploit traffic for the flaw has been seen in the wild, and they urge teams to patch now. The bug first surfaced as a Node.js problem, was later re-scoped to the Brotli library, and picked up several names along the way.

## Which Node.js releases fix Node2Shell

The Node.js project fixed the flaw on October 21 in releases 22.23.4, 24.22.1 and 26.12.1, according to [Sysdig](https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce). Bun 1.4.4 carries a fix as well. The table below lists fixed versions for the main components covered in the vendor advisories and write-ups reviewed.

| Component | Fixed release | Notes |
|---|---|---|
| Node.js 22 | 22.23.4 | Released October 21 |
| Node.js 24 | 24.22.1 | Released October 21 |
| Node.js 26 | 26.12.1 | Released October 21 |
| Bun | 1.4.4 | Patched release |
| Brotli library | 1.0.10, 1.1.1, 1.2.1 | Affected from 1.0.3 through 1.2.0 |
| Python brotli | 1.2.1 | brotlicffi 1.2.1.0 also fixes; affected from 1.0.3 |
| .NET | 8.0.33, 9.0.22, 10.0.14 | Microsoft released updates October 25 |

Node.js 20.x and older, along with 23.x and 25.x, are end-of-life and will receive no fix. For those systems, upgrading to a supported release line is the only remedy, according to [Rescana](https://www.rescana.com/post/nodejs-cve-2026-111497-node2shell-brotli-rce-october-2026). Teams on those lines should treat migration as the fix, not a follow-up task.

## Why the patch gap is the real problem

The timeline is the uncomfortable part. Google committed its Brotli fix on February 27, 2026, with no release and no advisory. The change stayed publicly readable for about eight months before fixed releases shipped, according to [Help Net Security](https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/) and [Cycode](https://cycode.com/blog/node2shell-cve-2026-111497/). Anyone who read the public code could see the change long before downstream teams had something to deploy.

Vendors have moved at different speeds. As of October 26, SUSE and standard Red Hat Enterprise Linux repositories had no fix, while Debian, Alpine and Amazon Linux had patches available, according to [Aikido](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497). An earlier tracker showed Debian without a fixed package on October 23, and later reports list Debian patches. Check your distribution's current advisory rather than trusting any single snapshot, including this one.

Microsoft released .NET updates for the same CVE on October 25, according to Cycode. A separate write-up from [Cybersecurity News](https://cybersecuritynews.com/http2shell-vulnerability/) says the reach extends beyond HTTP to .NET, FFmpeg, ClickHouse and Apache Arrow.

Inventory is hard for a reason. [Tanium](https://www.tanium.com/blog/http2shell-brotli-rce-huntiq) notes that Brotli often arrives as a dependency that nobody lists separately. A team can run a patched Node.js and still ship an old Brotli copy inside a vendored package or container image. Because Node.js is widely used by US web developers and companies, one stale base image can spread the problem across many deployments.

## Severity ratings: 9.2 critical versus High

The severity ratings disagree. Node.js rates its advisory High, while Google's CVSS v4.0 score is 9.2, which is critical. According to Rescana, Node.js's own advisory says the flaw "permits remote code execution." The sources reviewed do not explain the difference. For operators, the practical call matters more: any internet-facing service that decompresses attacker-supplied Brotli data should be treated as critical.

Outcomes range from crashes and memory disclosure to remote code execution, according to [Zscaler ThreatLabz](https://www.zscaler.com/blogs/security-research/cve-2026-111497-node2shell-http2shell-vulnerability-may-allow-rce). Because crashes can be the first visible symptom, unexplained restarts on services that decompress Brotli data deserve investigation before anyone writes them off as routine bugs.

## What to do this week

Start with anything that faces the internet, then work inward to build pipelines and internal tools. Apply these steps in order:

1. Check your exact Node.js release line, then upgrade to 22.23.4, 24.22.1 or 26.12.1, or a newer patch in that line.
2. Move any end-of-life Node.js (20.x and older, 23.x or 25.x) to a supported line.
3. Patch the Brotli library or distribution package. Patching Node.js does not fix separately bundled copies.
4. For container images, rebuild from freshly pulled base images and repin your tags.
5. If no fix is available for a service, disable Brotli decoding on exposed endpoints temporarily.

Checking only the Node.js major version is not enough. The Brotli version string is also a weak signal, because Node.js did not bump it, according to [ELLIO](https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/). Confirm the full release number instead.

## What remains unknown

Several basics remain open. CISA has not publicly detailed affected victims or the attacker's identity in the sources reviewed, and the scale of in-the-wild exploitation is unknown. Researchers have not established whether the activity is opportunistic or targeted.

Attribution is also unsettled. A separate report linked the PHP2Shell campaign to a China-nexus actor, but no link to Node2Shell has been found. PHP2Shell is a different flaw. USA 24 has covered it in [CISA Orders Federal PHP2Shell Fixes by October 29 After Exploits Surface](https://usa-24.com/php2shell-cve-2026-109618-patch/) and in a report on a [suspected North Korean group scanning 216 PHP servers](https://usa-24.com/php2shell-vulnerability-dprk-scan/) for PHP2Shell flaws.

Older coverage needs a caution. Some early analyses said exploitation was not confirmed and that the flaw was not listed in KEV as of October 23 and 24, according to [Phoenix Security](https://phoenix.security/http2shell-node2shell-cve-2026-111497-brotli-decoder-out-of-bounds-write/). Those statements predate CISA's October 27 listing, so do not treat them as current status.

## What comes next

The next two weeks will show whether the patch gap closes before November 10. Watch SUSE and Red Hat repositories, which had no fix as of October 26, and whether more distributions follow Debian, Alpine and Amazon Linux. Watch CISA for any detail on victims or exploitation patterns as well. Teams running end-of-life Node.js lines face a harder problem, because for them migration is the only remedy. Move the highest-exposure services first and confirm the fixed release number on each one.

## Frequently asked questions

### Which Node.js versions fix CVE-2026-111497?

The Node.js project fixed the flaw on October 21 in Node.js 22.23.4, 24.22.1 and 26.12.1, and Bun 1.4.4 also carries a fix. Node.js 20.x and older, plus 23.x and 25.x, are end-of-life and will receive no fix. For those lines, upgrading to a supported release is the only remedy.

### What is the November 10 deadline for Node2Shell?

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27 and set November 10, 2026 as the remediation deadline for federal civilian agencies. Private companies face no such federal deadline, but they carry the same exposure if they run affected Node.js or Brotli software.

### Does patching Node.js fix every Brotli copy on my system?

No. Patching Node.js does not fix separately bundled Brotli copies, so Linux packages, Python libraries and container images may need their own updates. Fixed Brotli releases are 1.0.10, 1.1.1 and 1.2.1, and the Python packages brotli 1.2.1 and brotlicffi 1.2.1.0 fix the flaw.

### What other names does the Node2Shell flaw go by?

The flaw is also called HTTP2Shell and Broccoli2Shell. It was first reported as a Node.js bug and later re-scoped to the Brotli library, which is why several names circulate in security reports.

## Sources

1. [CISA Warns of Active Attacks Exploiting Critical Node2Shell RCE Vulnerability in Node.js](https://gbhackers.com/cisa-warns-node2shell-rce-vulnerability-in-node-js/)
2. [Node2Shell: Node.js Brotli Flaw CVE-2026-111497 Added to CISA KEV](https://www.rescana.com/post/nodejs-cve-2026-111497-node2shell-brotli-rce-october-2026)
3. [node2shell (CVE-2026-111497): What to Patch in Node.js](https://cycode.com/blog/node2shell-cve-2026-111497/)
4. [Brotli bug reaches far beyond Node.js (CVE-2026-111497)](https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/)
5. [Node2Shell (CVE-2026-111497) aka HTTP2Shell and Broccoli2Shell: RCE analysis](https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/)
6. [Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE](https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce)
7. [Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)
8. [CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE](https://www.zscaler.com/blogs/security-research/cve-2026-111497-node2shell-http2shell-vulnerability-may-allow-rce)
9. [HTTP2Shell (CVE-2026-111497): How a Brotli Decoder RCE Spread](https://phoenix.security/http2shell-node2shell-cve-2026-111497-brotli-decoder-out-of-bounds-write/)
10. [Hunt or be Hunted: The Crash That Gives HTTP2Shell Away](https://www.tanium.com/blog/http2shell-brotli-rce-huntiq)
11. [HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow](https://cybersecuritynews.com/http2shell-vulnerability/)