CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

CISA has placed the Brotli compression library bug nicknamed Node2Shell (also called HTTP2Shell or Broccoli2Shell) on its Known Exploited Vulnerabilities list, giving federal agencies until November 10 to remediate CVE-2026-111497. The out-of-bounds write flaw affects Brotli versions 1.0.3 through 1.2.0 and can let attackers crash apps, leak memory, or run arbitrary code, with Node.js, Microsoft, Bun, Envoy, Istio and Palo Alto Networks all shipping fixes. Honeypot operators Previdian and ELLIO independently captured live attack attempts in late October — ELLIO's sensors caught a request against Node.js 24.22.0 from an IP previously tied to PHP2Shell and VPN-scanning activity, though the attacker's custom exploit payload failed to produce a shell in testing. Broadcom has also disclosed that VMware Cloud Foundation and vSphere Foundation's SDDC Manager inherit the flaw via Node.js, rating it critical (CVSS 9.8) for version 9.1.1, with patches still pending and only interim workarounds available.