CISA warns of hackers now exploiting critical Node2Shell flaw

CISA has confirmed active exploitation of a critical Brotli decompression bug, nicknamed Node2Shell (also called Broccoli2Shell or HTTP2Shell), and added it to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-111497, is an out-of-bounds write in Google's Brotli decoder that lets an unauthenticated attacker send a specially crafted compressed stream to corrupt memory, leak data, crash a service, or in some cases achieve remote code execution. Originally spotted in Node.js, the issue also affects HTTP servers, clients, and other software bundling vulnerable Brotli libraries, prompting Microsoft to issue an emergency .NET patch over the weekend warning of possible privilege escalation. Under Binding Operational Directive 26-04, US federal agencies must remediate by November 10, and CISA is urging all organizations to patch quickly, restart affected services, rebuild containers, or temporarily block Brotli-compressed traffic if immediate updates aren't possible.