The U.S. government now has a clock running on one of the more widespread bugs in the Node.js ecosystem. On October 27, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog and set November 10 as the remediation deadline for federal agencies, according to GBHackers. The Node2Shell vulnerability, also tracked as HTTP2Shell and Broccoli2Shell, sits in Google's Brotli decoder, a compression component that Node.js bundles. That means the flaw can reach any software that decompresses Brotli data, not only Node.js applications.
The listing matters well beyond federal offices. The KEV catalog tracks flaws with evidence of active exploitation, so an addition signals that attacks have moved past theory. Private companies face no federal deadline, but many US developers run Node.js behind web apps, APIs and webhook handlers, and any public service that accepts compressed requests can be targeted.
Researchers at ELLIO Threat Research Lab say exploit traffic for the flaw has been seen in the wild, and they urge teams to patch now. The bug first surfaced as a Node.js problem, was later re-scoped to the Brotli library, and picked up several names along the way.
Which Node.js releases fix Node2Shell
The Node.js project fixed the flaw on October 21 in releases 22.23.4, 24.22.1 and 26.12.1, according to Sysdig. Bun 1.4.4 carries a fix as well. The table below lists fixed versions for the main components covered in the vendor advisories and write-ups reviewed.
| Component | Fixed release | Notes |
|---|---|---|
| Node.js 22 | 22.23.4 | Released October 21 |
| Node.js 24 | 24.22.1 | Released October 21 |
| Node.js 26 | 26.12.1 | Released October 21 |
| Bun | 1.4.4 | Patched release |
| Brotli library | 1.0.10, 1.1.1, 1.2.1 | Affected from 1.0.3 through 1.2.0 |
| Python brotli | 1.2.1 | brotlicffi 1.2.1.0 also fixes; affected from 1.0.3 |
| .NET | 8.0.33, 9.0.22, 10.0.14 | Microsoft released updates October 25 |
Node.js 20.x and older, along with 23.x and 25.x, are end-of-life and will receive no fix. For those systems, upgrading to a supported release line is the only remedy, according to Rescana. Teams on those lines should treat migration as the fix, not a follow-up task.
Why the patch gap is the real problem
The timeline is the uncomfortable part. Google committed its Brotli fix on February 27, 2026, with no release and no advisory. The change stayed publicly readable for about eight months before fixed releases shipped, according to Help Net Security and Cycode. Anyone who read the public code could see the change long before downstream teams had something to deploy.
Vendors have moved at different speeds. As of October 26, SUSE and standard Red Hat Enterprise Linux repositories had no fix, while Debian, Alpine and Amazon Linux had patches available, according to Aikido. An earlier tracker showed Debian without a fixed package on October 23, and later reports list Debian patches. Check your distribution's current advisory rather than trusting any single snapshot, including this one.
Microsoft released .NET updates for the same CVE on October 25, according to Cycode. A separate write-up from Cybersecurity News says the reach extends beyond HTTP to .NET, FFmpeg, ClickHouse and Apache Arrow.
Inventory is hard for a reason. Tanium notes that Brotli often arrives as a dependency that nobody lists separately. A team can run a patched Node.js and still ship an old Brotli copy inside a vendored package or container image. Because Node.js is widely used by US web developers and companies, one stale base image can spread the problem across many deployments.
Severity ratings: 9.2 critical versus High
The severity ratings disagree. Node.js rates its advisory High, while Google's CVSS v4.0 score is 9.2, which is critical. According to Rescana, Node.js's own advisory says the flaw "permits remote code execution." The sources reviewed do not explain the difference. For operators, the practical call matters more: any internet-facing service that decompresses attacker-supplied Brotli data should be treated as critical.
Outcomes range from crashes and memory disclosure to remote code execution, according to Zscaler ThreatLabz. Because crashes can be the first visible symptom, unexplained restarts on services that decompress Brotli data deserve investigation before anyone writes them off as routine bugs.
What to do this week
Start with anything that faces the internet, then work inward to build pipelines and internal tools. Apply these steps in order:
- Check your exact Node.js release line, then upgrade to 22.23.4, 24.22.1 or 26.12.1, or a newer patch in that line.
- Move any end-of-life Node.js (20.x and older, 23.x or 25.x) to a supported line.
- Patch the Brotli library or distribution package. Patching Node.js does not fix separately bundled copies.
- For container images, rebuild from freshly pulled base images and repin your tags.
- If no fix is available for a service, disable Brotli decoding on exposed endpoints temporarily.
Checking only the Node.js major version is not enough. The Brotli version string is also a weak signal, because Node.js did not bump it, according to ELLIO. Confirm the full release number instead.
What remains unknown
Several basics remain open. CISA has not publicly detailed affected victims or the attacker's identity in the sources reviewed, and the scale of in-the-wild exploitation is unknown. Researchers have not established whether the activity is opportunistic or targeted.
Attribution is also unsettled. A separate report linked the PHP2Shell campaign to a China-nexus actor, but no link to Node2Shell has been found. PHP2Shell is a different flaw. USA 24 has covered it in CISA Orders Federal PHP2Shell Fixes by October 29 After Exploits Surface and in a report on a suspected North Korean group scanning 216 PHP servers for PHP2Shell flaws.
Older coverage needs a caution. Some early analyses said exploitation was not confirmed and that the flaw was not listed in KEV as of October 23 and 24, according to Phoenix Security. Those statements predate CISA's October 27 listing, so do not treat them as current status.
What comes next
The next two weeks will show whether the patch gap closes before November 10. Watch SUSE and Red Hat repositories, which had no fix as of October 26, and whether more distributions follow Debian, Alpine and Amazon Linux. Watch CISA for any detail on victims or exploitation patterns as well. Teams running end-of-life Node.js lines face a harder problem, because for them migration is the only remedy. Move the highest-exposure services first and confirm the fixed release number on each one.
