Cybersecurity

CISA Warns Hackers Are Exploiting Critical Node2Shell Flaw

The US Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of the critical Node2Shell vulnerability, which affects implementations of Google's Brotli compression algorithm across various environments.

Radwan AbdulhadiEditor and technology writer

Published: October 28, 2026 · Updated: October 28, 2026 · 3 min read

CISA Warns Hackers Are Exploiting Critical Node2Shell Flaw — Image: BleepingComputer

CISA Confirms Active Exploitation of Node2Shell

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that malicious actors have begun actively exploiting a critical vulnerability within Google's widely popular Brotli lossless compression algorithm. As reported by BleepingComputer, this severe security issue is commonly referred to in the industry by several names, including Node2Shell, Broccoli2Shell, and HTTP2Shell.

Cataloged officially as CVE-2026-111497, the core weakness arises from an out-of-bounds write vulnerability residing directly inside the Brotli decoder used for expanding compressed data. While the flaw was initially identified in the Node.js JavaScript runtime environment, security researchers have noted that it also extends to a broader range of HTTP servers and client applications that rely on vulnerable Brotli implementations.

Technical Mechanics and Potential Impacts

Unprivileged attackers can exploit the vulnerability by supplying a maliciously crafted Brotli-compressed stream. According to security analysis, this vector can trigger application crashes or sensitive memory leaks, and in more severe cases, it allows malicious operators to gain remote code execution on target devices housing vulnerable libraries or binaries.

CISA warned that the vulnerability allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, or cause a denial of service. The agency emphasized that such flaws represent a frequent vector for malicious cyber attacks and introduce substantial risks to enterprise environments.

US government says hackers are now exploiting critical PHP web bugs — Image related to the report from TechCrunch · Source: TechCrunch

Emergency Vendor Patches and Directives

In response to the escalating threat landscape surrounding the compression flaw, major tech vendors have moved quickly to release safety updates. Microsoft recently pushed out an emergency .NET security update after warning that adversaries could exploit the vulnerability to escalate privileges across affected systems running vulnerable versions of .NET.

Following these developments, CISA formally added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Under its Binding Operational Directive 26-04, the agency instructed US civilian federal agencies to patch their systems within a strict two-week window, setting a strict deadline for remediation.

Mitigation Guidance for Network Defenders

While CISA's binding operational directive targets federal civilian agencies, the cybersecurity agency strongly advised all private sector network defenders and IT administrators to prioritize immediate patching to mitigate incoming attacks.

For enterprise security teams unable to apply the official software updates right away, alternative mitigation steps are available. Administrators can block incoming Brotli-compressed requests directly at the firewall or proxy level, or temporarily disable the Brotli decoding feature until proper updates can be thoroughly tested and deployed.

Furthermore, experts stress that applying patches is only half the battle. Administrators must restart affected processes, rebuild container images, and completely redeploy them to ensure lingering instances of the vulnerable decoder state are eradicated from production networks.