Security2 hOctober 28, 2026, 15:37

CISA adds Node2Shell to KEV catalog as honeypots log attacks

CISA has added the Brotli flaw CVE-2026-111497, also known as Node2Shell and HTTP2Shell, to its Known Exploited Vulnerabilities catalog after honeypots recorded exploitation attempts. The out-of-bounds write affects Brotli 1.0.3 through 1.2.0 and can lead to code execution; federal agencies must patch by November 10.

SecurityWeek

Open source

CISA adds Node2Shell to KEV catalog as honeypots log attacks

Flaw affects Brotli 1.0.3–1.2.0; fixes were released on October 21
Imperva demonstrated code execution on an official Node.js image
ELLIO saw an attempt against Node.js 24.22.0, but the exploit was broken
Broadcom rates VMware SDDC Manager risk at CVSS 9.8, patches pending

#CISA#Brotli#Node.js#VMware

Node2Shell: memory-corruption RCE in Brotli affects Node.js

Security

Python Brotli and brotlicffi packages vulnerable to Node2Shell exploit

Security

Node2Shell RCE hits official Node.js build via crafted Brotli data

Security

CISA adds Node2Shell to KEV catalog as honeypots log attacks

Node2Shell: memory-corruption RCE in Brotli affects Node.js

Python Brotli and brotlicffi packages vulnerable to Node2Shell exploit

Node2Shell RCE hits official Node.js build via crafted Brotli data

Plex Media Server RCE chain of four CVEs lands in CISA KEV catalog