Node2Shell is now in CISA’s exploited-flaw catalogue: check the runtime still serving traffic

CISA has added CVE-2026-111497, the Brotli decompression flaw also called Node2Shell, to its Known Exploited Vulnerabilities catalogue. The entry is dated October 27. That changes the practical urgency: advice based on there being no known exploitation is now out of date, even though the catalogue does not establish how widespread attacks are.

The bug affects a component used by several software ecosystems. For Node.js users, the October security release provides fixes in 22.23.4, 24.22.1 and 26.12.1. Those are the first fixed versions in the listed release lines, not a reason to downgrade a newer supported installation.

Exposure follows the data being decompressed

Brotli compresses data to reduce transfer size. The vulnerable decoder can mishandle malformed input and write beyond an internal buffer. Node.js describes possible consequences ranging from a process crash to memory disclosure and remote code execution.

The necessary connection is an application decompressing data an attacker can influence. That can happen when a service accepts compressed requests, but it can also happen when the service fetches a remote resource and decodes the response. A server does not become safe merely because its inbound upload endpoint refuses Brotli.

The HTTP2Shell nickname can obscure this scope. The affected operation is Brotli decoding; it is not confined to websites using HTTP/2. Conversely, a computer having Node.js installed does not by itself prove that a reachable application exposes this particular input path. Inventory and application behaviour both matter.

Updating one copy may leave another running

A system package, a container image and an application's bundled runtime can contain separate copies of the same dependency. Updating the operating system's Brotli library does not establish that the Node.js runtime used by a service has changed. The useful verification is the version and dependency set of the process that actually handles traffic.

The broader Node.js release also repairs DNS, certificate-verification and other issues. Treating it as a single-library swap can miss protections delivered by the complete supported runtime update. End-of-life branches need a supported upgrade path rather than an assumption that an old version escaped the problem.

What the exploitation notice does—and does not—say

CISA's listing is evidence that the vulnerability has been exploited. It does not mean every affected deployment has been compromised, and its catalogue entry lists known ransomware use as unknown. Those distinctions are useful when prioritising a response without inventing an incident.

The operational failure to avoid is finishing a package update while an old process or image keeps serving requests. For this flaw, the meaningful endpoint is a verified running deployment with the fix, followed by an assessment of its earlier exposure. A clean-looking update log is only one step along that route.