CISA warns of hackers now exploiting critical Node2Shell flaw

Node2Shell is the name used for a critical vulnerability in Brotli’s decoder. Brotli is a lossless compression algorithm, and the decoder expands compressed data. The flaw is an out-of-bounds write, meaning the decoder can write beyond the memory area it should use. That can corrupt nearby decoder state and expose systems to attack.

An attacker does not need valid credentials. They can send a maliciously crafted Brotli-compressed stream to vulnerable software. The stream may trigger a crash or memory leak. In some cases, it can corrupt adjacent memory and allow remote code execution on devices using vulnerable Brotli libraries or binaries.

CISA tracks the issue as CVE-2026-111497 and says it is being exploited. The flaw first appeared in Node.js, but vulnerable Brotli implementations also affect HTTP servers, clients, and .NET systems. Defenders should patch, or temporarily block Brotli-compressed requests or disable decoding.

The vulnerability is not limited to the Node.js JavaScript runtime. The article says it also affects HTTP servers and clients that rely on vulnerable Brotli implementations. Microsoft separately issued an emergency .NET security update because vulnerable .NET versions could allow privilege escalation.

For example, a server or client that automatically decodes incoming Brotli-compressed data may process an attacker’s crafted stream. If its Brotli decoder is vulnerable, the data can trigger memory corruption, crashes, or memory disclosure. A .NET system may face privilege escalation instead, according to Microsoft’s warning.

The practical scope depends on whether software includes an affected Brotli library or binary. This makes the issue relevant to more than one runtime or product category. Administrators must identify vulnerable implementations across servers, clients, .NET systems, and deployed application environments, then patch and restart or redeploy them.

The damage depends on the vulnerable implementation and how the corrupted memory is used. At the lower end, a malicious Brotli stream can crash a process, causing denial of service. It can also disclose sensitive contents from memory through a memory leak.

The key mechanism is an out-of-bounds write in the decoder. The attacker-controlled compressed data causes the decoder to corrupt adjacent decoder-state memory. That corruption can change how the program operates, expose information, or create conditions for arbitrary code execution. Microsoft also warned that vulnerable .NET systems could experience privilege escalation.

CISA describes the flaw as capable of causing memory disclosure, denial of service, or potentially arbitrary code execution. Remote code execution is especially serious because it can let an attacker run commands on an affected device remotely. Exploitation is already occurring, so organizations should patch urgently and apply temporary controls if necessary.

CISA placed the vulnerability in its Known Exploited Vulnerabilities Catalog after confirming that hackers had begun exploiting it. The agency considers the flaw a significant risk because attackers can use a crafted Brotli stream to corrupt memory, disclose information, cause denial of service, or potentially execute arbitrary code.

The deadline comes from CISA’s Binding Operational Directive 26-04. It requires US government agencies to patch their systems within two weeks, by November 10. This requirement applies to federal agencies, not every organization. It reflects the immediate danger created by active exploitation and the range of possible consequences.

CISA also urged all network defenders to prioritize patching, even though the directive is limited to federal agencies. Organizations unable to update immediately should block incoming Brotli-compressed requests or disable Brotli decoding. The response must also include restarting affected processes and rebuilding and redeploying affected container images.

Brotli is Google’s widely popular lossless compression algorithm. Software uses a decoder to expand Brotli-compressed data after it arrives. Because the decoder may be built into different products, a single vulnerability can affect many kinds of systems rather than one application.

The article specifically names HTTP servers and clients that rely on vulnerable Brotli implementations. It also describes the original discovery in Node.js and an emergency Microsoft update for vulnerable .NET versions. An incoming web request, a client response, or application data can therefore reach the same kind of vulnerable decoding logic.

Containerized applications can also be affected when their images include vulnerable libraries or binaries. Updating a host alone may not update code inside an existing image. Administrators must rebuild and redeploy affected images after patching. They should also restart affected processes so updated components replace vulnerable running instances.

Organizations that cannot apply updates immediately have two main defenses described by CISA. They can block incoming Brotli-compressed requests at a proxy or firewall. They can also disable the Brotli decoding feature until the vulnerable software is updated. These measures reduce exposure while the permanent fix is prepared.

Patching files is not enough if affected processes are still running old code. Administrators must restart those processes after updating. Otherwise, the vulnerable component may remain loaded in memory and continue handling data. The same principle applies to containers, where an existing image may still contain the vulnerable library or binary.

For that reason, CISA says administrators must rebuild and redeploy affected container images after patching. The temporary controls should be removed only after updated components are active and tested. Since the flaw is being exploited, organizations should treat these steps as urgent containment and recovery actions.

Lossless compression reduces the size of data while preserving every original detail. Decoding reverses that process by expanding compressed data back into usable content. Brotli’s decoder performs that expansion. An out-of-bounds write happens when software writes beyond the memory space reserved for its current operation.

With this flaw, a crafted Brotli-compressed stream can make the decoder write into adjacent decoder-state memory. That nearby data may contain information the decoder needs to operate safely. Corrupting it can crash the process, expose sensitive memory contents, or create denial of service. The article identifies this unchecked memory corruption as the core weakness.

Memory safety errors can also affect instructions, control information, or data used to decide what a program does next. If an attacker can control the corruption reliably, the program may be redirected to run attacker-supplied instructions. That is why CISA says the flaw can potentially lead to arbitrary code execution, including remotely.