[Urgent] Node.js / Brotli CVE-2026-111497: Added to CISA KEV on Oct 27 — Update to 22.23.4 / 24.22.1 / 26.12.1; Apps That Decompress Brotli Are the Target (CVSS v3.1 9.8)

CVE-2026-111497, a flaw in the Brotli compression library (CVSS v3.1 9.8 CRITICAL), was added to the KEV (Known Exploited Vulnerabilities) catalog of CISA, the US cybersecurity agency, on October 27, 2026. KEV lists vulnerabilities that have actually been exploited. Making a program decompress crafted Brotli data can corrupt memory, leak memory contents, crash the service and, depending on conditions, lead to code execution. If you run web services or APIs on Node.js, update to 22.23.4, 24.22.1 or 26.12.1.

We mentioned this as one of Node.js's 10 fixes in our October 23 weekly roundup, but the situation has changed since. The Node.js advisory of October 21 says nothing about exploitation. CISA added the flaw to KEV on October 27, and on October 30 Singapore's Cyber Security Agency (CSA) issued an alert saying a public proof-of-concept exists and exploitation has been reported.

Where the score comes from: 9.8 (CVSS v3.1: network, low complexity, no privileges, no user interaction) is NIST's own rating in the NVD. Google separately rates it 9.2 CRITICAL under CVSS v4.0. The Node.js advisory rates the same flaw "High", so ratings differ by source. This article uses the NVD's v3.1 score.

What happens (as publicly documented)

• ▸Where: the Brotli decoder. Given malformed compressed data, the decoder writes past the end of an internal buffer (Node.js advisory)
• ▸Consequences: a crash, disclosure of process memory, or remote code execution (Node.js advisory). The attack works when an application decompresses Brotli data sent by an attacker (CSA alert)
• ▸Exploitation: CISA added it to KEV on October 27, with a federal deadline of November 10. CISA does not say how many attacks, when, or by whom. The CSA says a public proof-of-concept exists and exploitation has been reported
• ▸Nicknames: also called "Node2Shell" and "HTTP2Shell" (JVN). We do not describe attack steps here

Affected versions and what to update to

• ▸Node.js: fixed in 22.23.4 / 24.22.1 / 26.12.1 (released October 21). Node.js states that end-of-life versions are always affected when a security release ships. The advisory lists fixes for these three lines only
• ▸Brotli itself: 1.0.3 up to below 1.0.10, 1.1.0 up to below 1.1.1, and 1.2.0 up to below 1.2.1 are affected; fixed in 1.0.10 / 1.1.1 / 1.2.1 (Google, NVD, JVN)
• ▸Python packages: `brotli` is affected from 1.0.3 up to below 1.2.1 and fixed in 1.2.1; `brotlicffi` is affected from 1.0.3 up to below 1.2.1.0 and fixed in 1.2.1.0 (GitHub advisory). JPCERT/CC lists Bun and Python Brotli packages as examples alongside Node.js
• ▸.NET: fixed in 8.0.33 (.NET 8), 9.0.22 (.NET 9) and 10.0.14 (.NET 10) (Microsoft advisory, October 25). .NET Framework is stated as not affected

What to do today

• ✓★Check your Node.js version. Run `node --version` on servers and CI; for containers, `docker run --rm <image> node --version`. A tag pinned to a version older than the fix, such as `node:24.22.0`, stays vulnerable
• ✓★Update to 22.23.4, 24.22.1 or 26.12.1 and restart the processes. For containers, rebuild the image and redeploy
• ✓Move to a supported release line. Lines with no fixed version in the advisory (20.x, 23.x, 25.x and so on) cannot be fixed by updating
• ✓If you use Node.js through OS packages or a managed service, check your provider's advisory. If you can't update the environment yourself, it is up to the provider
• ✓Find where your own code uses the Brotli functions of `node:zlib` (`brotliDecompress`, `createBrotliDecompress`). The Node.js advisory describes the case where an attacker can supply Brotli data that the application decompresses with `node:zlib`. Whether frameworks or networking libraries call it internally is not confirmed in official sources
• ✓Check non-Node.js components too: Python Brotli packages, .NET, Bun and others, using the versions above
• ✓Look through logs before and after updating for application crashes or suspicious requests. Prioritize internet-facing services (our addition)

If you can't update right now

The Node.js advisory lists no workaround other than updating. Google's Brotli doesn't give one either (JPCERT/CC). We do not list stopgaps that vendors have not published, because we cannot vouch for them. If you can't update yet, prioritize these two points.

• ▸Update internet-facing services first. The basis for the order is that the flaw is in KEV and that the CSA says a public proof-of-concept exists
• ▸Check your provider's advisory (hosting company, managed service, distribution) and ask when they will update. Keep logs from the period before the update so you can investigate afterwards

What we could not confirm

• ▸The number, timing or actors of real attacks. CISA does not say. This article cannot tell you whether anyone in Japan was affected
• ▸Whether your own app meets the attack conditions. The attack works when the app decompresses Brotli data sent by an attacker (CSA). Whether it decompresses request bodies or outside responses differs by app, and official sources do not settle it
• ▸Whether stopgaps work. Researchers and the press mention rejecting requests with `Content-Encoding: br` at a proxy, among others, but vendor documentation does not confirm this. It may also not cover responses your app fetches from outside
• ▸Status of 20.x, 23.x and 25.x. The Node.js advisory gives no fixed version. The NVD's affected range is below 22.23.4, 23.0.0 up to below 24.22.1, and 25.0.0 up to below 26.12.1
• ▸Spillover to other products. Many products bundle Brotli, and JPCERT/CC asks you to check each vendor's information. This article is not exhaustive

Three lines to share

• ▸CVE-2026-111497 in Node.js / Brotli (CVSS v3.1 9.8) was added to CISA's "known exploited" catalog (KEV) on October 27. Making an app decompress crafted data can lead to code execution
• ▸★Update Node.js to 22.23.4 / 24.22.1 / 26.12.1 and restart. Rebuild containers. There are no fixed versions for 20.x, 23.x or 25.x, so move to a supported line
• ▸If you can't update at once, put internet-facing services first. Check your provider's advisory and keep logs until the update

Pages we relied on