CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
The US cybersecurity agency CISA has added the Brotli vulnerability known asNode2Shellto its Known Exploited Vulnerabilities (KEV) catalog. Separately, two security firms say they have recorded exploitation attempts against their honeypots.
Tracked as CVE-2026-111497 and also known as HTTP2Shell and Broccoli2Shell, the flaw is an out-of-bounds write in the decoder of Brotli, the data compression library developed by Google.
It impacts Brotli versions 1.0.3 through 1.2.0. With specially crafted compressed data, an attacker could crash the application, expose the contents of its memory, and potentially execute arbitrary code.
The bug was reported by researchers at OpenAI, and Node.js and Google released fixes on October 21. Microsoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.
Imperva has demonstrated that the vulnerability can be exploited for code execution on an official Node.js image.
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
