GoKawiilCISA confirms active exploitation of Brotli flaw CVE-2026-111497, sets Nov 10 patch deadline
CISA confirmed attackers are actively exploiting a critical vulnerability in Google's Brotli compression library, dubbed Node2Shell, that can let unauthenticated attackers crash systems, leak memory, or run arbitrary code. The agency added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 10 under Binding Operational Directive 26-04. Microsoft separately issued an emergency .NET update days earlier addressing related privilege-escalation risk from the same flaw.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Brotli is embedded widely in Node.js, HTTP servers and clients, the flaw's reach likely extends far beyond federal systems CISA directly regulates, which is why the agency is urging all network defenders to act. The emergency Microsoft patch suggests the vulnerability's impact spans multiple major software ecosystems, raising the stakes for organizations that haven't yet assessed their exposure.
- CVE-2026-111497 is a critical out-of-bounds write flaw in the Brotli decoder enabling crashes, memory leaks, or remote code execution.
- CISA mandates federal agencies patch by November 10, 2026 under BOD 26-04, and urges all organizations to prioritize fixes.
- Microsoft issued an emergency .NET update addressing related privilege-escalation risk from the same underlying vulnerability.
Source: bleepingcomputer.com, 2026-10-28
Published there as: “CISA warns of hackers now exploiting critical Node2Shell flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.