CISA warns of hackers now exploiting critical Node2Shell flaw

Key Points:

• The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of a critical vulnerability (CVE-2026-111497) in the Brotli compression algorithm, affecting systems using vulnerable Brotli libraries or binaries.
• The flaw, originating from an out-of-bounds write in the Brotli decoder, allows unprivileged attackers to cause crashes, memory leaks, or potentially execute remote code via malicious Brotli-compressed streams.
• Initially discovered in Node.js, the vulnerability also impacts HTTP servers and clients relying on Brotli, prompting Microsoft to release an emergency .NET update addressing related privilege escalation risks.
• CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog and mandated US federal agencies to patch affected systems by November 10 under Binding Operational Directive 26-04, while urging all network defenders to prioritize mitigation.
• Until patches are applied, organizations are advised to block Brotli-compressed requests at network boundaries or disable Brotli decoding, and to restart affected services and redeploy containers after updating.