CISA has confirmed that attackers are exploiting a critical vulnerability in Brotli, tracked as CVE-2026-111497. It circulates under several names, including Node2Shell, Broccoli2Shell and HTTP2Shell. The available reporting is short, so this post covers what is known, what is unclear, and what a sensible response looks like.
What happened
According to BleepingComputer, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Tuesday that hackers have begun exploiting a critical Brotli vulnerability. BleepingComputer's social post gives the identifier as CVE-2026-111497 and lists the three aliases above.
The sources I reviewed do not include:
- which Brotli versions or downstream products are affected
- which versions contain a fix
- the technical details of the exploit or the attack chain
- who is being targeted or how widespread the exploitation is
I am not filling those gaps with assumptions. The aliases hint at a link to Node.js and HTTP handling, but the sources do not confirm which products are affected, so treat that as unverified.
Why it matters
CISA confirming active exploitation changes the priority. A critical flaw that is only theoretical can wait for the normal patch cycle. One that attackers are already using needs a quick answer to a simple question: are we exposed?
That question is harder than it sounds for a library like Brotli. Components of this kind are often pulled in indirectly, through runtimes, frameworks, web servers or proxies, so they may not appear in anyone's list of direct dependencies. Teams without a current SBOM or dependency inventory will feel this most.
The multiple names also create a practical problem. Advisories, scanners and vendor notes may use different labels, so searching by CVE ID is more reliable than searching by nickname.
What you should do
The sources do not name specific mitigations, so this is general hygiene rather than guidance for this flaw:
- Inventory: search lockfiles, SBOMs, container images and base images for Brotli, including transitive dependencies.
- Search by ID: look for CVE-2026-111497 in advisories from the vendors of your runtimes, web servers, proxies and frameworks.
- Prioritise exposure: start with internet-facing services, then move to internal ones.
- Watch for guidance: follow CISA's advisory and the original report for affected versions, fixes and any recommended mitigations, and apply vendor patches as soon as they are available.
- Monitor: review logs on exposed services for unusual behaviour, and make sure your incident response contacts are current.
I will treat this as a developing story. If you have confirmed details on affected versions or fixes from an official source, those should take precedence over anything here.
Top comments (0)