Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns

CISA has added the Node2Shell flaw, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities catalog. Attackers are already sending live exploit traffic at Node.js servers, so teams should patch right away. CISA added the bug to its Known Exploited Vulnerabilities catalog on October 27, 2026. Federal agencies must fix it by November 10, 2026. CISA lists it as an unchecked return value flaw in Google Brotli. It says a remote attacker with no login can use a crafted Brotli stream to corrupt memory, leak data, crash the app, or possibly run code. CISA marks ransomware use as unknown. It also says forensic triage is not required under BOD 26-04. The flaw goes by several names. Researchers call it Node2Shell, HTTP2Shell, Broccoli2Shell and Brotli2Shell. Google’s CNA gives it a 9.2 Critical score under CVSS 4.0. The bug is an…