The Brotli decoder bug is now on CISA's exploited list after a first attack on Node.js 24.22.0 (CVE-2026-111497)

CISA added the Brotli decoder bug, CVE-2026-111497, to its Known Exploited Vulnerabilities catalog at 3:00 PM ET on Tuesday, October 27 (catalog version 2026.10.27). US federal civilian agencies have until November 10 to patch. The add came one day after ELLIO's sensors caught the first exploit attempt in the wild: a single 23,069,983-byte Brotli-compressed request body built to take over one exact binary, the official Node.js 24.22.0 release for x86-64.

Nothing about the fix has changed since October 21. If you upgraded Node.js, rebuilt your images and patched the system Brotli library after our first write-up of this bug, there is nothing new to install. What changed is the clock, and the fact that someone has now aimed a real payload at it.

How to fix

Upgrade the runtime that does the decompressing, then restart or redeploy whatever runs it. Node.js is the line the observed payload targets:

# Node.js (the decoder is compiled into the binary; no npm bump fixes it)
nvm install 24.22.1          # or 22.23.4, or 26.12.1
# Docker: pin the patched tag, rebuild, redeploy
FROM node:24.22.1-bookworm-slim

# Confirm inside the running container, not on your laptop
node -v
node -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH"
# -17 = patched, undefined = vulnerable

Every other copy of the decoder needs its own update. These are the fixed versions listed in the vendor advisories and collected in Tenable's FAQ:

A patched package on disk does nothing for a process that loaded the old decoder. Restart long-running workers and rebuild container images and CI runners, because each carries its own copy.

What the first attack looked like

ELLIO says its sensors saw the request at 15:08 UTC on October 26 (11:08 AM ET), from 94.154.43.7. The day before, a public scanner calling itself node2shell-check sent 20 Brotli bodies in two bursts, which only tells it whether a host decompresses Brotli at all. ELLIO rates the exploit source as malicious with high confidence and says the same address has a record of PHP2Shell exploitation, GlobalProtect and FortiOS SSL VPN probing and Kubernetes API scanning. That reads like a mass-exploitation operator adding a new bug to its list, not a researcher.

The delivery layer is a byte-for-byte copy of the public proof-of-concept tooling. The final stage is not. Instead of pointing at a /bin/sh string already inside Node, it plants its own and makes Node call execvp with arguments it smuggled into memory. Every address in it is specific to the official Node.js 24.22.0 x86-64 build.

It also did not work. ELLIO replayed the attacker's payload 50 times against a clean, vulnerable 24.22.0 target and got zero shells. The process crashed on each miss. ELLIO's own chain, built from the public construction, does return a shell on the same target. So the first attempt failed because of a bug in its last few instructions, and the working version is already public.

Check whether your servers were hit

Three things to look for on any Node.js service that was on a vulnerable version after October 21:

# 1. The one source address ELLIO published
grep -rF "94.154.43.7" /var/log/nginx/ /var/log/haproxy* 2>/dev/null

# 2. Unexplained crashes or restarts of Node processes since Oct 21
journalctl -u your-node-service --since 2026-10-21 | grep -iE "exited|killed|core dump"
kubectl get pods -A -o wide | awk '$5 > 0'     # RESTARTS column above zero

# 3. If your proxy logs request size and Content-Encoding:
#    a ~23 MB br-encoded body to a JSON route is not normal traffic

A crash is the expected result of this particular payload, so a Node worker that died and came back on its own around October 26 is worth a look. ELLIO also published the payload's SHA-256 (7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b) for anyone who keeps full request bodies. A miss here does not clear you: other operators will use other addresses and the public chain.

Unlike PHP2Shell on yesterday's list, CISA did not mark this entry as needing forensic triage under BOD 26-04, and it lists ransomware use as unknown.

Who is not in scope

• Services already on fixed versions and restarted. The KEV add is about the same bug and the same fixes as October 21.
• .NET apps that never opted into Brotli decompression. Microsoft says ASP.NET Core request decompression and HttpClient automatic response decompression are off by default, and .NET Framework is not affected.
• Envoy and Istio without a Brotli decompressor configured. The compressor alone is not the entry point.
• Code that only compresses, and browsers. The patch is in the decoder. Front-end JavaScript uses the browser's own Brotli.

The observed payload only fits the official Node.js 24.22.0 x86-64 binary. A distro-built Node, an arm64 host or another 24.x point release would not run this specific chain, but each is still vulnerable to one built for it. Imperva showed code execution on the arm64 image on October 22.

What this is not

It is not a confirmed break-in. No victim has been named, CISA does not publish the evidence behind KEV entries, and the only payload described in public crashes the process instead of opening a shell. Treat the November 10 date as the latest you should be patching, not the plan, since the gap between this attacker's chain and a working one is a few instructions that are already published.

Where HOL Guard fits

HOL Guard pauses risky actions by AI coding agents on developer machines. It does not patch Node.js or filter Brotli streams, so the fix is still the upgrade. The sources, scope and timeline for this issue live in the HOL Guard evidence pack for CVE-2026-111497.

References

• CISA Known Exploited Vulnerabilities catalog (CVE-2026-111497 added 2026-10-27, due 2026-11-10)
• ELLIO: Node2Shell, remote code execution on stock Node.js builds (update 26 Oct)
• Tenable: Brotli2Shell FAQ
• Imperva: Node2Shell, from Brotli data to remote code execution
• Google Brotli v1.2.1 release
• Node.js: October 2026 security releases
• Microsoft: .NET Brotli decoder advisory for CVE-2026-111497
• HOL: Node.js CVE-2026-111497 Brotli decoder write-up (Oct 22, with .NET, git and PHP updates)