CISA adds Brotli CVE-2026-111497 (Node2Shell) to KEV as exploited

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October, confirming active exploitation of the out-of-bounds write in the Brotli decompression library — the flaw researchers demonstrated as "Node2Shell" against Node.js. Federal agencies have until 10 November to remediate under Binding Operational Directive 26-04. Notably, CISA catalogs the entry under "Google | Brotli", not Node.js: this is an upstream library bug, and every runtime that bundles a vulnerable Brotli decoder is in scope.

What's affected

Brotli ships inside far more than one runtime. Node.js patched it on 21 October in its October 2026 security releases across the 22.x, 24.x, and 26.x lines, after Imperva turned the decoder bug into a working RCE PoC it called Node2Shell. Microsoft shipped an emergency .NET update for the same class of flaw. The exposure is anywhere untrusted Brotli-compressed data reaches a vulnerable decoder — fetch() responses carrying content-encoding: br, middleware that decodes Brotli request bodies, and appliances that embed the library.

Exploitation status

CISA states exploitation is confirmed in the wild; the catalog entry names no threat actor. The KEV add and the BOD 26-04 deadline are the new facts here — the PoC and patch were public a week earlier. A library-level flaw with a published RCE technique and a short federal clock is the profile attackers move on fast.

Action checklist

1. Patch the runtime, not just the app. Update Node.js to the fixed 22.x / 24.x / 26.x release, apply Microsoft's out-of-band .NET update, and check any appliance or container base image that bundles Brotli.
2. After patching, restart affected processes and rebuild and redeploy container images — a running process keeps the vulnerable library mapped.
3. As an interim control, block Brotli-compressed requests at the proxy/firewall or disable Brotli decoding where you can tolerate it.
4. Federal and KEV-aligned orgs: this is due 10 November. Inventory every Brotli consumer before then.

Context

This is the widening-blast-radius pattern a shared compression library always produces. We covered the original Node.js patch and the Node2Shell PoC on 24 October, and the same CVE reaching Palo Alto PAN-OS through its Brotli dependency. A bug in a dependency this common isn't one vendor's problem — it is a dependency-graph problem, and the KEV listing under "Google | Brotli" is CISA making exactly that point.