Google · Exploitation confirmed

CISA Confirms Active Node2Shell Exploitation as WordPress Vector Emerges

· 4 min read

A critical out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 9.2), dubbed Node2Shell, allows unauthenticated remote code execution in Node.js, Bun, Python packages, Envoy, Istio, PHP for Windows, Microsoft products and Palo Alto firewalls that inspect Brotli. CISA confirmed active exploitation, added the flaw to the KEV with a federal deadline of November 10, and a researcher added a WordPress vector via /xmlrpc.php with a public exploit. Update to the patched versions (Node.js 22.23.4, 24.22.1 and 26.12.1; Brotli 1.2.1), restart services, rebuild container images and monitor /xmlrpc.php.

By Updated Get this every day →← Back to the feed 21 sources
WhatsApp LinkedIn X
CriticalVulnerabilityExploitation confirmedPartial fix
In this article
  1. What happened
  2. Why it matters
  3. What to do
  4. For the technical team
  5. Timeline
  6. Sources

What happened

A critical flaw in Google's Brotli compression component lets attackers run commands on servers that decompress malicious data, with no credentials required. The flaw is embedded in widely used products: Node.js, Bun, Python packages.NET, Visual Studio, PowerShell, PHP for Windows, Envoy, Istio and Palo Alto firewalls. CISA confirmed active exploitation and set a federal remediation deadline of November 10.

Incidents like this, every morning

The ones that need action first, in a 3-minute read.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Why it matters

Any application that decompresses content from untrusted sources (requests, responses, files) can be taken over. A public proof of concept exists, attempts were recorded in honeypots, and a researcher disclosed a vector against WordPress sites via /xmlrpc.php. Running processes stay vulnerable after updating until they are restarted, and container images must be rebuilt.

What to do

Update to: Node.js 22.23.4, 24.22.1 or 26.12.1; Brotli 1.2.1; Bun 1.4.4; Python packages Brotli 1.2.1 and brotlicffi 1.2.1.0; Microsoft's October 25 updates; rebuilt PHP Windows builds. Restart services, rebuild container images, disable Brotli inspection on Palo Alto firewalls until patched, and monitor access to /xmlrpc.php.

For the technical team

CVE
CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
Affected
Google (Brotli) Decodificador Brotli (libbrotli) embutido em Node.js, Bun.NET, Envoy, Istio e Python (brotli, brotlicffi), nos pacotes oficiais do PHP para Windows (8.2 a 8.5), em firewalls Palo Alto que descriptogra · Google Brotli 1.0.3 through 1.2.0 (analysis lists 1.0.3 to 1.0.9, 1.1.0 and 1.2.0), all platforms; Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1; end-of-life lines 20.x, 23.x, 25.x and older affected with no fix; Bun before 1.4.4; PyPI Brotli up to 1.2.0 and brotlicffi up to 1.2.0.2; Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 with a Brotli decompressor configured (GHSA-3wvj-j6qm-62mr); Istio before 1.29.9/1.30.6/1.31.2 that decompresses Brotli; official PHP Windows packages 8.2 to 8.5, reachable via the cURL extension with automatic decompression (disabled by default); Microsoft .NET 8.0, 9.0, 10.0 and 11.0 RC, Visual Studio 2019 16.11, 2022 17.14, 2026 18.11, PowerShell 7.4, 7.5 and 7.6 before the October 25, 2026 updates; Palo Alto firewalls that decrypt TLS and inspect Brotli. A public tracker lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as still unpatched (incomplete list, per its maintainers).
Exploitation
CISA confirms active exploitation, added the CVE to the KEV with a federal deadline of November 10 and reports RCE exploitation attempts; two honeypot operators recorded attempts, one with a defective exploit; a batch reports scans and active exploitation against default x86-64 Node.js installations. Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, with malicious data in a server response and in a body processed by Express 5/body-parser 2; the exploit was not made public and the proof did not succeed on every attempt. SecurityWeek reports a public GitHub PoC achieving code execution only against an intentionally weakened build, and researchers who argued the bug was only usable for DoS. A researcher reports obtaining a shell during client work; a researcher added a WordPress vector via /xmlrpc.php with a public exploit; an r/netsec discussion combines the WordPress pingback with the Brotli RCE; a consultancy reports finding vulnerable versions in production during penetration tests.
Fix
Brotli 1.0.10, 1.1.1 and 1.2.1 (commit google/brotli@0ed4268, new error BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, −17); Node.js 22.23.4, 24.22.1 and 26.12.1; Bun 1.4.4; PyPI Brotli 1.2.1 and brotlicffi 1.2.1.0 (silently patched, no mention in release notes); Envoy 1.40.0/1.39.3/1.38.6/1.37.8 (1.36.12 too, unsupported); Istio 1.29.9/1.30.6/1.31.2; Microsoft October 25, 2026: .NET 8.0.33/9.0.22/10.0.14 and 11 RC3, Visual Studio 2019 16.11.61, 2022 17.14.43, 2026 18.11.2, PowerShell 7.4.22/7.5.13/7.6.9; PHP published rebuilt Windows builds with Brotli 1.2.1; Palo Alto expects a fix on October 30 and until then recommends disabling Brotli inspection. Applying updates requires restarting affected services and rebuilding container images on a patched base, since running processes keep the vulnerable code.
Vector
Out-of-bounds write (CWE-787) in the C Brotli decoder (c/dec/decode.c) caused by an unchecked return value (CWE-252): DecodeBlockTypeAndLength returns an ambiguous boolean, the fast decode path discards it, and an invalid block switch is treated as needing more input, leading to writes past the ring buffer. Unauthenticated exploitation requires the application to decompress attacker-controlled Brotli data: request bodies (Express 5/body-parser 2), responses fetched via fetch, node:zlib, or compressed files.
More details
Node.js credits the discovery to OpenAI Codex Security (Khai Tran and Sylvie Mayer), found during red-teaming; OpenAI says the root cause was fixed in the Brotli source in February, unknown at the time to be a security issue, with no subsequent release. CVE assigned by Google, affected product github.com/google/brotli; OpenSourceMalware attributes the October 21, 2026 disclosure to Imperva. Alternate names: HTTP2Shell and Broccoli2Shell. Microsoft categorizes it as elevation of privilege, CVSS v3.1 8.1, critical for .NET and Visual Studio and important for PowerShell, with exploitability 'Exploitation More Likely'. Researchers launched a site and open-source tool to test whether an HTTP client is vulnerable. In the same Node.js security release (October 21, 2026), CVE-2026-105482 has a public PoC: dns.resolve* and dns.reverse silently truncate names containing a NUL byte, an incomplete fix of CVE-2026-48930.

Indicators (IoCs)

  • /xmlrpc.php

Timeline

  1. A discussion on r/netsec covers combining the WordPress pingback feature with the Brotli decoder RCE.

  2. Public PoC released for CVE-2026-111497 in the Brotli decoder, with affected versions listed as 1.0.3 through 1.2.0.

  3. X alert reiterates active exploitation of CVE-2026-111497 in popular software that bundles the brotli library.

Want the next updates in your inbox? Get the daily edition →

See all 24 updates

  1. Researcher adds a WordPress attack vector via /xmlrpc.php and points to a public exploit to test for the flaw.

  2. Security firm reports still finding vulnerable Brotli decoder versions in production during client red team engagements.

  3. Researcher stresses the Brotli decoder flaw is very much exploitable and urges immediate patching.

  4. Researchers demonstrate the Node2Shell RCE exploit running attacker code on a Node.js build via crafted Brotli data.

  5. Public PoC released for CVE-2026-105482 in Node.js: dns.resolve*() and dns.reverse() silently truncate hostnames containing a NUL byte, an incomplete fix of CVE-2026-48930.

  6. CISA confirms hackers are actively exploiting CVE-2026-111497, the Brotli flaw also known as Node2Shell.

  7. CISA added the Brotli decoder flaw to its KEV catalog, and two honeypot operators logged exploitation attempts, including one with a broken exploit.

  8. Batch adds that active exploitation now hits stock x86-64 Node.js with live scanning, and lists fixed versions 22.23.4, 24.22.1, and 26.12.1.

  9. CISA listed the flaw in KEV and reports RCE exploit attempts; the federal deadline is November 10.

  10. Researchers released an open-source website to check whether an HTTP client is vulnerable to CVE-2026-111497, dubbed Node2Shell/HTTP2Shell.

  11. Researcher reports real-world exploitation of the Brotli decoder flaw, claiming to have popped a shell during a client engagement.

  12. Palo Alto warns that firewalls decrypting TLS and inspecting Brotli traffic are also affected; fixes are due by 30 October and Brotli inspection should be disabled until then.

  13. Analysis lists the affected Brotli decoder versions (1.0.3 through 1.0.9, 1.1.0 and 1.2.0), assigns CVSS 9.2, and shows the flaw circulating as HTTP2Shell, Node2Shell and Broccoli2Shell.

  14. PHP ships rebuilt Windows packages with Brotli 1.2.1; the vulnerable decoder was reachable via the cURL extension with automatic HTTP decompression enabled, a feature disabled by default.

  15. PHP rebuilds its official Windows packages for PHP 8.2-8.5; the bundled Brotli flaw is reachable through the cURL extension when it auto-decompresses HTTP responses, a setting off by default.

  16. New report details that CVE-2026-111497 also affects Bun, the Python Brotli and brotlicffi packages.NET, and Envoy proxies.

  17. Post lists fixed versions: Node.js 22.23.4, 24.22.1 and 26.12.1, and Bun 1.4.4.

  18. Cloudflare ships two emergency Managed Ruleset rules to detect exploitation of CVE-2026-111497, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint.

  19. The flaw is being dubbed HTTP2Shell and has triggered emergency patches.

  20. Microsoft ships an emergency update for CVE-2026-111497, the Brotli bug OpenAI's Codex Security reported to Node.js; two of its Oct 13 fixes fell short.

  21. Google and affected ecosystems ship fixes for the Brotli decoder across many products.

Sources 21 sources

See all 30 sources

Get the next one tomorrow morning

One email a day with what changed, what to fix first and how. After signing up you get the full feed.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Share it with your team

Whoever handles security with you should get it too.

LinkedIn X

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

Read also

Before you go: get this every day

The HIFY Radar daily edition lands every morning with the incidents that need action. Free.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click