Brotli RCE Vulnerability Node2Shell Added to CISA KEV

The Brotli RCE vulnerability CVE-2026-111497, known as Node2Shell, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 27. Brotli is compression code that sits inside runtimes, web servers and browsers, so the flaw lives in places nobody lists as a product. On October 26, researchers still disagreed on how reliably it gives code execution; CISA now lists it as exploited.

What Happened With the Brotli RCE Vulnerability

The Brotli RCE vulnerability is a memory-corruption flaw in the decoder of Google Brotli, versions 1.0.3 through 1.2.0. NVD describes it as a buffer overflow with an unchecked return value. A remote, unauthenticated attacker who gets a program to decompress a crafted Brotli stream can corrupt decoder memory, read memory contents, crash the process or potentially run code. Google scores it 9.2 (CVSS v4); Red Hat scores it 8.1 (CVSS v3.1) because the stream has to be precisely malformed. As of October 28, NVD lists its own analysis as pending.

Fixed Brotli versions are 1.0.10, 1.1.1 and 1.2.1. Node.js shipped fixes on October 21 in 22.23.4, 24.22.1 and 26.12.1. The Python packages Brotli (1.2.1) and brotlicffi (1.2.1.0) are fixed, Microsoft released emergency .NET updates on October 25, and HKCERT also points to a PHP update of October 26.

CISA added the flaw to KEV on October 27 and set a federal due date of November 10. As of October 28, Security Affairs reports exploitation attempts: Previdian recorded one by October 27, and ELLIO saw traffic carrying a public exploit. How widespread this is remains unclear.

Why It Matters

You will not find Brotli on an asset list. It is built into Node.js, bundled in Python packages and .NET, used by web servers that accept Content-Encoding: br, and embedded in Firefox and Thunderbird. Red Hat points out that you are only exposed if an application decompresses Brotli data an attacker can supply, but that covers any web service accepting compressed requests and any client fetching from a server it does not control.

Patching the package is not the end. A process that is still running keeps the old library in memory, and a container image built on an old base image stays vulnerable until it is rebuilt. We covered PHP2Shell on October 21 and again in our October 28 blog, another engine-level flaw; this one is harder to inventory because it hides inside dependencies.

What You Should Do Now

1. Find where Brotli runs: Node.js services, .NET applications, Python services using Brotli or brotlicffi, reverse proxies and web servers with br encoding, and software that bundles its own copy. On Red Hat systems, check the brotli, nodejs, firefox and thunderbird packages.
2. Update to fixed versions (Brotli 1.0.10, 1.1.1 or 1.2.1; Node.js 22.23.4, 24.22.1 or 26.12.1; Microsoft’s October 25 .NET update), then restart the affected processes and rebuild and redeploy container images.
3. If you cannot patch today, block or strip Content-Encoding: br from untrusted clients at the proxy or firewall, or disable Brotli decoding until you can update, as CISA and Red Hat advise. Do not pass untrusted data to Brotli decompression calls.
4. Watch for crashes and restarts of services that handle br traffic, and for unexpected child processes or outbound connections from them. We found no published indicators of compromise in the sources we checked.

DIESEC Perspective

Library flaws are inventory problems before they are patching problems. If you cannot say which services decompress untrusted data, or which images were rebuilt after the update, you cannot show an auditor or a customer that the fix reached production.

Not sure which of your services use Brotli, or whether patched systems were restarted and rebuilt? Contact DIESEC for an exposure review and patch verification.

Sources: BleepingComputer | NVD | Red Hat RHSB-2026-015 | HKCERT | Security Affairs
Published: 2026-10-29 | Category: Vulnerabilities & Patches | ~4 min read