CISA adds Node2Shell CVE-2026-111497 to KEV; federal deadline is Nov 10

Timing: CISA added this CVE to its KEV catalog on 27 October 2026. We publish on 30 October, three days later. This is a catch-up on the KEV listing and the first attack reports, not breaking news.

What happened

US federal agencies now have until 10 November 2026 to fix CVE-2026-111497. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 October.

The flaw is the out-of-bounds write in the Google Brotli decoder behind Node2Shell. CISA lists it under Google Brotli, not under Node.js. So the deadline covers every product that bundles an affected decoder.

The CISA entry says a crafted Brotli stream can corrupt memory, leak memory, crash a process, or "potentially" run code. CISA marks ransomware use as unknown. It gives no detail on who attacked what.

We checked the KEV JSON feed (catalog 2026.10.29) on 30 October.

What the sensors saw

Two sensor networks report exploit traffic. Neither reports a confirmed compromise.

• ELLIO, 26 October. Its decoys logged one Brotli request body of about 23 MB at 15:08 UTC. It targeted the official Node.js 24.22.0 x86-64 build. The day before, a public checker had mapped which hosts decompress Brotli at all.
• The payload failed. ELLIO replayed it 50 times on a vulnerable 24.22.0 server. It got zero shells. Each try crashed the process. ELLIO calls it a "first-generation attempt".
• Same source, other targets. ELLIO says the same IP address also ran PHP2Shell attacks and probed VPN devices. It reads this as a mass-exploitation operator picking up the bug.
• Previdian, from 27 October. Its sensors observed exploitation attempts from 27 to 29 October. Previdian rates the evidence "confirmed" but says that does not mean an attempt succeeded.

So the KEV listing reflects real attack traffic. It does not prove that servers were taken over.

Where exploits stand

• Lab RCE exists. Imperva ran code on Node.js 24.22.0 arm64 on 22 October. ELLIO says it got shells on 24.22.0 x86-64 in its lab, with a chain built from public parts.
• It is build-specific. ELLIO's working value for 24.22.0 gave nothing in 10,000 tries on 22.23.3 and 26.12.0. Each build needs its own tuning.
• It is probabilistic. Most of ELLIO's lab attempts crashed the worker instead. Memory layout randomization (ASLR) turns RCE into a numbers game.
• A crash is easy. Every miss kills the worker. For defenders, denial of service is the more portable risk today.
• Public PoCs are lab code. The repository by dimasma0305 reports RCE only in pinned lab setups. We found no public exploit that works across production builds.

ThreatWire did not run any exploit. We do not link attack payloads.

Who is affected

Anything that decompresses untrusted Brotli data with Brotli 1.0.3 to 1.2.0:

• Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. End-of-life lines get no fix. Exposed paths include node:zlib, built-in fetch() and Express 5 / body-parser 2 request parsing.
• Other software that bundles the decoder: Bun, Envoy, Istio, .NET, the Python brotli packages, ClickHouse, Apache Arrow, FFmpeg through libjxl, and PHP for Windows through cURL. See Brotli2Shell and the PHP Windows rebuild.

Google, the CVE issuer, scores it CVSS 4.0 9.2 (Critical). Node.js rates it High.

What to do

1. Patch Node.js. Move to 22.23.4, 24.22.1 or 26.12.1, released 21 October. Leave end-of-life lines.
2. Rebuild images. A container that pins 24.22.0 stays vulnerable. Check the Node.js version inside each image, not only the host.
3. Patch other copies. Use Brotli 1.0.10, 1.1.1 or 1.2.1, and each vendor's fixed release.
4. Turn off inbound Brotli if you can. Reject request bodies sent with Content-Encoding: br at the proxy or in your body parser, where you do not need them.
5. Add a WAF or proxy rule. Large br-encoded request bodies are rare. Log them and block them until you are patched. This reduces risk; it is not a fix.
6. Watch for crashes. A burst of Node.js segfaults or restarts after big br requests deserves a look. ELLIO warns that crash core dumps can hold other users' session data, so restrict and expire them.
7. Find hidden copies. Use the defensive tools below.

Defensive tools

• Assetnote node2shell-scanner checks whether a Node.js HTTP endpoint is vulnerable. It does not run a command. It sends one large probe, so test only systems you own.
• Trail of Bits Brotli Checker finds vulnerable Brotli copies in projects, packages, containers and stripped binaries.
• Aikido Brotli client checker tests the other side: your HTTP clients. It serves a crafted stream from a test server. It may crash a vulnerable client, so run it in a throwaway container.

Related coverage

• Node2Shell: crafted Brotli data runs code in Node.js
• Brotli2Shell reaches .NET, FFmpeg, ClickHouse and Arrow
• PHP rebuilds Windows builds for the Brotli flaw

Record: CVE-2026-111497. Browse the CVE tracker.

Sources: the CISA KEV catalog and JSON feed, the Node.js security release post, Google Brotli, NVD, CVE.org, ELLIO, Previdian, Assetnote, Trail of Bits and Aikido. Links are in the references list.