Node2Shell Brotli Flaw Under Active Attack: What Businesses Need to Check Now

Sophos researchers have warned that a critical vulnerability, tracked as CVE-2026-111497 and widely known as Node2Shell, is being actively exploited. It carries a severity score of 9.2 out of 10. The flaw is a buffer overflow in the Brotli decoder found in multiple versions of Google's Brotli software. Node.js released updates for it on October 21, 2026. It has also been called Broccoli2Shell and HTTP2Shell.

Successful exploitation could lead to memory disclosure, denial of service, or remote code execution. Because the problem sits in the Brotli library itself, any product that relies on a Brotli implementation may be vulnerable. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities Catalog on October 27, confirming that attacks are happening.

Sophos Counter Threat Unit researchers recommend that organisations identify vulnerable Brotli libraries or binaries and update to the latest version where appropriate. They also advise assessing which products in your environment could be at risk. Several vendors, including Microsoft and PHP, have published updates for their products. SophosLabs is continuing to monitor for related activity and will release detections and protections as they become available. This summary is based on the opening of the Sophos article, so check the full report and your vendors' advisories for further detail.