Cybersecurity officials order emergency fixes for widely targeted Brotli compression flaw

The Cybersecurity and Infrastructure Security Agency has added a critical Brotli vulnerability to its Known Exploited Vulnerabilities Catalog, warning that attackers are actively exploiting the bug in the wild. Tracked as CVE-2026-111497 and dubbed Node2Shell, Broccoli2Shell, and HTTP2Shell, the flaw stems from an out-of-bounds write weakness in the decoder of Google's compression algorithm. Under Binding Operational Directive 26-04, federal agencies must patch vulnerable systems by November 10, while honeypot operators have already begun logging exploit attempts. [1][2]

The vulnerability allows unauthenticated remote attackers to send crafted compressed streams to corrupt decoder state memory, leak sensitive data, trigger denial-of-service crashes, or execute arbitrary code. Initially spotted in the Node.js runtime, the flaw also impacts HTTP servers and clients utilizing vulnerable Brotli libraries. Microsoft responded Sunday by releasing an emergency .NET security update to prevent attackers from escalating privileges on unpatched systems. [1]

CISA is urging all organizations to treat remediation as an immediate priority. For environments unable to install updates right away, administrators are advised to disable Brotli decoding or block Brotli-compressed traffic at their proxies and firewalls. Once patches are applied, defenders must rebuild and redeploy affected container images and restart associated system processes. [1]