On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers had begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
Tracked as CVE-2026-111497, this critical severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google’s popular Brotli lossless compression algorithm.
Unprivileged attackers can use a maliciously crafted Brotli compressed stream to trigger crashes or memory leaks and, in some cases, achieve remote code execution on devices with vulnerable Brotli libraries or binaries.
The security issue was first identified in the Node.js JavaScript runtime, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.
Microsoft also released an emergency .NET security update on Sunday, warning that attackers could exploit it to elevate privileges on systems with a vulnerable .NET version.
CISA added the flaw to its catalog of known exploited vulnerabilities (KEV) on Tuesday and ordered US government agencies to patch their systems within two weeks, by November 10, as required by its Binding Operational Directive (BOD) 26-04.
“Google Brotli contains an uncontrolled return value vulnerability that allows an unauthenticated, remote attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a Brotli-crafted compressed stream,” it said.
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and present significant risks to the federal enterprise.”
Although CISA BOD 26-04 only applies to federal agencies, the cybersecurity agency urged all network defenders to prioritize fixing this security vulnerability to block incoming attacks.
Security teams that cannot apply updates immediately should block incoming Brotli-compressed requests at the proxy or firewall level, or disable Brotli decoding functionality until they can update.
After patching, administrators must also restart affected processes and rebuild and redeploy affected container images.
Overall prevention scores can mask what happens after initial access. Once attackers use valid credentials, prevention drops significantly.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Gn tech
