'Node2Shell' Vulnerability (CVE-2026-111497) in Active Exploitation
Sophos, Wednesday, October 28th, 2026
Sophos CTU warns that Node2Shell (CVE-2026-111497), a critical Brotli decoder buffer overflow, is under active exploitation and on CISA's KEV list.
Node.js released fixes on October 21, 2026 for a buffer overflow in the Brotli decoder rated CVSS 9.2, also called Broccoli2Shell and HTTP2Shell.
It affects multiple Google Brotli versions and products using them, and can lead to memory disclosure, denial of service or remote code execution.
CISA added it to the Known Exploited Vulnerabilities Catalog on October 27.
Sophos CTU recommends finding vulnerable Brotli libraries or binaries and updating; Microsoft and PHP have published updates.