CISA Adds Critical Brotli Vulnerability CVE-2026-111497 to Exploited Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical Brotli compression algorithm vulnerability, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, which has been associated with monikers such as Node2Shell, Broccoli2Shell, and HTTP2Shell, permits attackers to trigger memory corruption and potential remote code execution.

Understanding the Vulnerability

The issue arises from an out-of-bounds write weakness within the Brotli decoder. By utilizing a maliciously crafted Brotli-compressed stream, an unprivileged attacker can cause memory leaks, system crashes, or execute arbitrary code. While originally identified in the Node.js environment, the vulnerability extends to various HTTP servers and client implementations that utilize the Brotli library.

Federal Mandates and Patch Requirements

Following the inclusion of the flaw in the KEV catalog, CISA issued Binding Operational Directive (BOD) 26-04, requiring all U.S. federal agencies to secure their systems by November 10.

Key remediation steps include:

• Patching: Applying updates provided by software vendors, including the emergency .NET security update released by Microsoft.
• Restarting Services: Ensuring that all affected processes are restarted after the update is applied.
• Deployment: Rebuilding and redeploying any container images that incorporate vulnerable libraries.

Guidance for Network Defenders

Although BOD 26-04 applies directly to government agencies, CISA strongly advises all private and public sector security teams to prioritize this update. For those unable to patch immediately, CISA suggests the following temporary mitigations:

• Block incoming Brotli-compressed requests via firewalls or proxies.
• Temporarily disable the Brotli decoding feature in affected systems.

Administrators are advised to monitor official vendor security bulletins for ongoing updates related to CVE-2026-111497.