‘Node2Shell’ vulnerability (CVE-2026-111497) in active exploitation

Threat Research advisory vulnerability Node2Shell Brotli

On October 21, 2026, Node.js released updates to address multiple vulnerabilities, including an issue in Brotli decoder (CVE-2026-111497). This critical buffer overflow vulnerability (CVSS score of 9.2) has become widely known as Node2Shell but has also been referred to Broccoli2Shell and HTTP2Shell. The issue exists in the Brotli decoder (c/dec/decode.c) in multiple Google Brotli versions, and products that rely on Brotli implementations are vulnerable. Successful exploitation could lead to memory disclosure, denial of service, or remote code execution.

Active exploitation has been reported, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) Catalog on October 27.

Recommended actions

Counter Threat Unit™ (CTU) researchers recommend that organizations identify vulnerable Brotli libraries or binaries and update to the latest version as appropriate. Organizations should evaluate what products in their environments could be at risk. Multiple vendors, including Microsoft and PHP, have published updates to address this vulnerability in their products.

Sophos countermeasures

SophosLabs continues to monitor the threat landscape for activity related to this vulnerability and will deliver detections and protections as available.

About the Author(s)

Sophos Counter Threat Unit Research Team

Sophos Counter Threat Unit™ (CTU) researchers are recognized authorities in the cybersecurity field, regularly contributing expert analysis to global media, publishing technical analyses for the security community, and presenting about emerging threats at leading security conferences. Backed by Sophos’ advanced security technologies and a broad network of intelligence contacts and partners, the CTU™ plays a critical role in identifying and tracking threat actors and analyzing anomalous activity, uncovering new attack techniques, threats, and major shifts in the threat landscape.