A vulnerability first flagged as a Node.js issue has turned out to run far deeper into the software stack — and the US Cybersecurity and Infrastructure Security Agency (CISA) has now confirmed it is being actively exploited. CVE-2026-111497, known as HTTP2Shell (and earlier as Node2Shell or Broccoli2Shell), stems from a flaw in Google’s bundled Brotli C decoder library.
Key Takeaways
- CVE-2026-111497 (HTTP2Shell) is a flaw in Google’s Brotli decompression library affecting versions 1.0.3 to 1.2.0, not just Node.js, which bundles the same vulnerable code; both have been patched.
- CISA added the CVE to its Known Exploited Vulnerabilities catalog on 27 October 2026 after confirming active exploitation, and Check Point Research found automated scanning fingerprints in 33.8% of related telemetry.
- Keeper Security’s CISO recommends patching promptly, retiring end-of-life Node.js versions, and deploying privileged access management so a successful exploit finds fewer long-lived secrets to steal.
Beyond Node.js: Where the Brotli Flaw Actually Lives
According to Check Point Research, the vulnerability first gained attention as “Node2Shell” because Node.js was an obvious exposure path, but the underlying issue sits in Brotli decompression code that can also appear in other runtimes, packages, proxies, service-mesh components and container images — including Python Brotli packages, Bun, .NET, Envoy and Istio. The name HTTP2Shell does not mean the HTTP/2 protocol itself is vulnerable; the connection to October’s separate PHP2Shell flaw is operational rather than technical; both expose how much risk sits in foundational components that security teams rarely inventory directly.
From Proof-of-Concept to Confirmed Exploitation
Initial assessments treated the flaw as high severity but not critical, noting that a public proof-of-concept had so far only achieved code execution against a deliberately weakened test build. That picture has since changed: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October 2026 based on evidence of active exploitation. Check Point’s telemetry on the issue found that 90.5% of related requests contained Brotli-encoded payloads consistent with vulnerability-focused testing, 33.8% carried the fingerprint of the Patrowl automated scanning tool, and 24.5% specifically targeted upload and ingestion endpoints.
“The initial Node.js-focused view is too narrow. Security teams need to search across application, cloud, container, and infrastructure environments… Internet-facing services and systems that automatically decompress external Brotli data should be assessed first,” Check Point Research said.
What Security Teams Should Do Now
Shane Barney, Chief Information Security Officer at Keeper Security, said the practical exposure for most organisations runs through what Node.js-powered applications can reach once an attacker gains code execution.
“Node.js runs the back end of many large platforms, and these applications typically hold database credentials, API keys and tokens. When an attacker does gain code execution, they can access whatever that application can reach… Organisations should patch promptly and retire end-of-life Node.js versions, which will not receive this fix. They should also limit what any single flaw can expose,” Barney said.
Barney recommends least privilege, just-in-time access and secrets governance to limit credential exposure in the event of remote code execution — with privileged access management vaulting and automatically rotating credentials so attackers find fewer long-lived secrets and a narrower window to use them. Check Point adds that teams should test reachability of untrusted compressed data to vulnerable decoders, patch by vendor and component rather than stopping at Node.js, and continue hunting for anomalous Brotli decompression errors even after patching.
