Cybersecurity

CISA Adds Node2Shell Flaw to KEV as Honeypots Log Attacks

The US cybersecurity agency has added the Node2Shell vulnerability to its Known Exploited Vulnerabilities catalog following reports of real-world attack attempts.

Radwan AbdulhadiEditor and technology writer

Published: October 28, 2026 · Updated: October 28, 2026 · 3 min read

CISA Adds Node2Shell Flaw to KEV as Honeypots Log Attacks — Image: SecurityWeek

CISA Adds Node2Shell to Known Exploited Vulnerabilities Catalog

The US Cybersecurity and Infrastructure Security Agency (CISA) has officially added the Brotli vulnerability, commonly known as Node2Shell, to its Known Exploited Vulnerabilities (KEV) catalog. CISA added CVE-2026-111497 on October 27, though the agency did not provide specific details regarding the initial attacks observed in the wild. Federal civilian agencies have been instructed to remediate the flaw by November 10.

Tracked as CVE-2026-111497 and alternatively referenced as HTTP2Shell or Broccoli2Shell, the security issue is classified as an out-of-bounds write in the decoder of Brotli, a data compression library originally developed by Google. The vulnerability impacts Brotli versions 1.0.3 through 1.2.0. When processing specially crafted compressed data, attackers can potentially crash target applications, expose sensitive memory contents, or execute arbitrary code.

Honeypots Record Real-World Attack Attempts

Independent security telemetry supports CISA's warning. Previdian, a firm monitoring exploitation activity via a proprietary network of sensors, reported capturing one exploitation attempt targeting CVE-2026-111497 originating from a US-based IP address. The company maintains a confirmed confidence rating for the event, clarifying that confidence describes how strongly evidence supports classifying the activity as exploitation rather than proof of a successful breach.

Similarly, cybersecurity lab ELLIO caught a malicious request directed at Node.js 24.22.0 running on x86-64 systems. The activity was preceded by reconnaissance probes using publicly available tooling to identify hosts capable of processing Brotli-compressed data. According to ELLIO, the attacking IP address had previously been linked to targeting PHP2Shell vulnerabilities and probing enterprise VPN appliances from vendors such as Palo Alto Networks and Fortinet.

Analysis of the Deployed Exploit and Impact

Despite observing active targeting, ELLIO's analysis of the exploit payload revealed significant defects. While the delivery components aligned with public proof-of-concept material, the custom final stage crafted by the attacker failed to establish a functioning shell during testing against vulnerable Node.js instances. Researchers characterized the incident as a first-generation field test involving a working framework paired with a defective final segment.

Security experts warn that even though the tested exploit failed to achieve remote code execution, failed attempts can inadvertently crash the target process, creating viable vectors for denial-of-service (DoS) attacks. Furthermore, Imperva has successfully demonstrated that the vulnerability can be weaponized for arbitrary code execution on official Node.js images under proper experimental conditions.

Industry Patching and VMware Exposure

The underlying vulnerability was originally reported by researchers at OpenAI. In response, Node.js and Google released patches, quickly followed by software updates from Microsoft, maintainers of various Python packages, Bun, Envoy, and Istio. Additionally, Palo Alto Networks began rolling out hotfixes across affected PAN-OS environments to mitigate potential risks.

Broadcom issued an advisory warning that SDDC Manager within VMware Cloud Foundation and vSphere Foundation relies on Node.js and is consequently affected by CVE-2026-111497. The company designated the issue with a critical CVSS score of 9.8 for SDDC Manager version 9.1.1, while marking versions 9.0.x, 9.1.0, and 5.2.x with an important severity rating. Official patches are currently pending, though workarounds have been published.