74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-111497 Brotli 'Node2Shell': exploited; patch now

Patch nowEnterprisefrom 2026-10

CVE-2026-111497 Brotli 'Node2Shell': exploited; patch now

Part of October 2026 patch cycle

Vendor
Microsoft
Products
.NET 8, .NET 9, .NET 10, .NET 11 RC, Node.js, Bun, Google Brotli, PAN-OS, and VMware SDDC Manager
Published
· updated
Status
Open

Update, Oct 28: the call is now Patch now. On Oct 27, CISA added CVE-2026-111497, the Brotli bug also going around as Node2Shell, HTTP2Shell and Broccoli2Shell, to its Known Exploited Vulnerabilities catalog. Federal agencies have until Nov 10. The evidence is thin but real: on Oct 26, ELLIO recorded one exploitation attempt against Node.js 24.22.0 on x86-64, built from public proof-of-concept code plus its own chain. Nobody has reported a confirmed victim, and Tenable hasn’t independently verified the attempt. Public PoCs are on GitHub. It’s the same bug in Node.js, Bun, the Brotli library itself and some appliances, so the fixed versions for all of them are below. (CISA, BleepingComputer, Tenable)

Call: Patch now. On Sunday, Oct 25, Microsoft shipped out-of-band .NET updates: 8.0.33, 9.0.22, 10.0.14 and 11 RC3. The main fix is CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Microsoft rates it CVSS 8.1 for .NET, and Google, as the CNA, scores it 9.2 (CVSS 4.0). Node.js fixed the same bug on Oct 21. It’s now in KEV, so if you decompress Brotli from strangers, this goes to the front of the queue.

What’s in it:

  • CVE-2026-111497, the Brotli fix. It affects all platforms.
  • CVE-2026-114148, a Linux tarball ownership issue.
  • Re-released fixes for CVE-2026-70197 and CVE-2026-102870. Microsoft says the Oct 13 release didn’t fully address them. If you closed those tickets two weeks ago, reopen them.

Who’s hit:

  • Apps that decompress attacker-controlled Brotli, through ASP.NET Core request decompression, HttpClient automatic decompression, or BrotliStream/BrotliDecoder directly.
  • Neither automatic decompression path is on by default.
  • .NET Framework isn’t affected.

Same bug, other places:

  • Node.js: 22.23.4, 24.22.1 and 26.12.1. The end-of-life lines 20, 23 and 25 get no fix, so upgrade off them.
  • Bun: 1.0.21 through 1.4.3 are affected. Update to 1.4.4, then rebuild any compiled executables, because they carry their own copy.
  • Google Brotli library: 1.0.10, 1.1.1 or 1.2.1. Anything that loads the system library is fixed only once it restarts. Python’s brotli 1.2.1 and brotlicffi 1.2.1.0 carry the fix too.
  • PAN-OS: Only 11.2.4 and later and 12.x, and only with Brotli inspection and dataplane decryption turned on. The management interface isn’t affected, and neither are 10.2, 11.1 or Panorama. The fix ships in the same hotfixes as php2shell, except 11.2.10-h16, so use 11.2.10-h17 on that train. Until then, run set system setting brotli-encoding disable and confirm with show system setting brotli. (Palo Alto)
  • VMware SDDC Manager (VMSA-2026-0008.1): Critical (9.8) on 9.1.1.x, Important (7.5) on 9.0.x, 9.1.0 and 5.2.x. Patches are still pending, so apply Broadcom’s manual workaround for now: KB460732 for 9.1.1.x, or KB460734 for 5.2.4, 9.0.2 and 9.1.0. (Broadcom)

Workaround / how to deploy:

  • Framework-dependent apps: Install the new runtime and restart the apps.
  • Self-contained apps, NativeAOT and containers: Rebuild and redeploy them, because they carry their own runtime and the host update does nothing for them. The same goes for Node.js and Bun images: an update you haven’t restarted or rebuilt is only paperwork.
  • If you can’t update yet: Remove br from your existing request decompression providers, or drop DecompressionMethods.Brotli from handlers that already set it. Don’t add decompression where you weren’t using it. At the edge, blocking requests with Content-Encoding: br stops the inbound path, but it does nothing for clients that fetch Brotli responses from a hostile server.

Sources: .NET Blog, GHSA-p3jp-9v83-76w9, Node.js October security releases, CISA KEV alert, Oct 27, Tenable FAQ, Bun GHSA-663w-cv8g-jj2p, Palo Alto, Broadcom VMSA-2026-0008.1.

Sources

More from October 2026 patch cycle