Update: In my HTTP2Shell post I covered the critical Brotli decoder flaw. On Tuesday, CISA confirmed attackers are now exploiting it. BleepingComputer notes it goes by several names, Node2Shell, Broccoli2Shell and HTTP2Shell, and it’s all CVE-2026-111497.
What’s new
- CISA added it to the Known Exploited Vulnerabilities catalog and gave federal agencies until Nov. 10 to patch.
- It’s an out-of-bounds write in the Brotli decoder. A crafted compressed stream can crash things, leak memory and in some cases run code. It was first found in Node.js but hits any HTTP server or client using a vulnerable Brotli build. Microsoft pushed an emergency .NET update on Sunday.
Checklist
- Patch Node.js, .NET and anything else bundling Brotli.
- If you can’t patch yet, block Brotli-compressed requests at the proxy or firewall, or turn off Brotli decoding.
- After patching, restart the affected processes and rebuild and redeploy container images. A patched host doesn’t fix an old image.
God Bless, and Needs Garlic!
