CISA Adds Exploited Brotli Flaw CVE-2026-111497 to KEV Catalog

CISA added CVE-2026-111497, a flaw in the Brotli compression library nicknamed Node2Shell or Broccoli2Shell, to its Known Exploited Vulnerabilities catalog on 27 October 2026, confirming that the vulnerability is being exploited in real attacks. The agency set a remediation deadline of 10 November 2026 for US federal civilian agencies, according to dailysecu.com.

The flaw is an out-of-bounds write in Brotli decompression that can cause memory corruption, exposure of sensitive data and service disruption, and may lead to remote code execution under certain conditions. Affected Google Brotli versions are 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, and 1.2.0 to before 1.2.1.

Potentially affected products include Node.js, Bun, Microsoft .NET, PowerShell, Envoy Proxy, Istio and the Python Brotli package. On 27 October 2026 Broadcom said in advisory VMSA-2026-0008 that SDDC Manager in VMware Cloud Foundation is affected; SDDC Manager 9.1.1 was rated CVSS 9.8, while 9.0.x, 9.1.0 and 5.2.x were rated CVSS 7.5. As of 28 October 2026 a full patch for SDDC Manager was still in preparation, with interim mitigations offered.

Red Hat said public proof-of-concept code demonstrated memory corruption and service disruption, but no reliable remote code execution exploit has been publicly confirmed.

Separate alerts in Canada and Korea

Canada's Canadian Centre for Cyber Security issued a separate urgent alert on 28 October 2026 recommending security checks for software using the Brotli library. On 26 October 2026, KISA published a security update advisory for the Google Brotli flaw.