The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a critical vulnerability in Google’s Brotli data-compression library. Tracked as CVE-2026-111497, the flaw could allow unauthenticated attackers to crash vulnerable systems, expose sensitive memory, corrupt decoder state or potentially execute arbitrary code.
Attackers exploit Brotli decoder vulnerability
On Tuesday, CISA said hackers had begun exploiting the vulnerability, which has been discussed under names including Node2Shell, Broccoli2Shell and HTTP2Shell.
The vulnerability is an out-of-bounds write weakness in the Brotli decoder, which decompresses data encoded with Google’s widely used Brotli lossless compression algorithm. An unprivileged attacker can send a maliciously crafted Brotli-compressed stream to a vulnerable library or binary, potentially causing a crash, leaking memory or achieving remote code execution.
The issue was first identified in the Node.js JavaScript runtime, but it also affects HTTP servers and clients that use vulnerable Brotli implementations.
Microsoft released an emergency .NET security update on Sunday, warning that attackers could exploit the vulnerability to escalate privileges on systems running affected .NET versions.
CISA adds CVE-2026-111497 to its exploited-vulnerability catalog
CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog and ordered U.S. government agencies to patch affected systems within two weeks, no later than November 10, as required by Binding Operational Directive (BOD) 26-04.
CISA described the issue as follows:
“An unchecked return value vulnerability exists in Google Brotli that could allow an unauthenticated, remote attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or execute arbitrary code via a crafted Brotli compressed stream.”
The agency added: “These types of vulnerabilities are a frequent attack vector for malicious cyber attackers and pose significant risks to federal enterprises.”
Although BOD 26-04 applies only to federal agencies, CISA urged all network defenders to prioritize patching the vulnerability to block incoming attacks.
Mitigations for systems awaiting updates
Organizations that cannot immediately install the available updates should block incoming Brotli-compression requests at the proxy or firewall level, or disable Brotli decoding until a security update is available.
After applying a patch, administrators should restart affected processes and rebuild and redeploy affected container images.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com