CISA Warns of Active Exploitation of Critical Brotli Flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) says attackers have begun exploiting a critical vulnerability in Brotli, Google's lossless compression algorithm. The flaw is tracked as CVE-2026-111497 and is also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.

The vulnerability is an out-of-bounds write in the Brotli decoder. A crafted compressed stream can cause crashes or memory leaks and, in some cases, let an unauthenticated remote attacker execute code on devices using vulnerable Brotli libraries or binaries. The issue was first identified in Node.js, but it also affects HTTP servers and clients that use vulnerable Brotli implementations.

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and directed US federal agencies to patch affected systems by November 10, under Binding Operational Directive (BOD) 26-04. The directive applies to federal agencies. CISA also urged all network defenders to prioritize updates.

Microsoft pushed an emergency .NET security update on Sunday, warning that attackers could exploit the flaw to escalate privileges on systems with a vulnerable .NET version. For systems that cannot be updated immediately, CISA advised blocking incoming Brotli-compressed requests at a proxy or firewall, or disabling Brotli decoding until an update can be applied. After patching, administrators should restart affected processes and rebuild and redeploy affected container images.