The Brotli bug we flagged is now under attack. Finish the Node.js and Python updates this week

We flagged the Brotli decoder bug on Monday and Microsoft’s .NET fixes on Tuesday. At that point there were proofs of concept and no attacks. That changed on Monday afternoon, when threat intelligence firm ELLIO recorded a real exploit attempt, and on Tuesday CISA added the flaw to its exploited list.

The first attempt failed in ELLIO’s own test. The sender is a mass-exploitation operator, so plan on the next one working.

The first in-the-wild Brotli exploit was built for one exact build, Node.js 24.22.0 on x86-64. If that is in your Dockerfile, change the line today.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Exploit traffic reached sensors, and CISA listed Brotli

At 15:08 UTC on October 26, ELLIO’s sensors received a single Brotli-compressed request body of about 23 MB aimed at Node.js v24.22.0 on x86-64. ELLIO says the delivery copied public proof-of-concept code byte for byte, while the final stage was an original construction. In ELLIO’s lab that chain crashed the target but scored no shells in 50 attempts, while the public chain did get a shell on the same build.

The traffic came from 94.154.43.7, an address ELLIO has seen running PHP2Shell exploits and probing Palo Alto GlobalProtect, FortiOS SSL VPN and Kubernetes APIs. On October 27 CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog with a federal due date of November 10.

Node.js 24.22.0 servers were the first target

Exposure depends on whether anything hands attacker-supplied Brotli data to the decoder. ELLIO lists three paths in Node.js: request bodies sent with Content-Encoding: br to Express 5 body parsers, body-parser 2 or Koa body parsers; responses that built-in fetch(), axios or got decode automatically; and direct node:zlib Brotli calls. Python clients such as requests, httpx and aiohttp decode Brotli responses as soon as the Brotli package is installed.

Each Node.js build needs its own memory offset, which is why the attempt targeted one version. ELLIO warns that a version shown in a banner, header, lockfile or container tag makes picking targets easy, and that a crash can also write other visitors’ tokens into a core dump.

Finish the Node.js, Python and image updates before November 10

• Move Node.js to 22.23.4, 24.22.1 or 26.12.1, and replace any image or Dockerfile pinned to 24.22.0 first. The 20.x, 23.x and 25.x lines get no fix.
• Update Python’s Brotli package to 1.2.1 and brotlicffi to 1.2.1.0, Bun to 1.4.4, and the system Brotli library to 1.0.10, 1.1.1 or 1.2.1 from your distribution.
• Rebuild container images, regenerate lockfiles and restart services; running processes keep the old decoder.
• Until every service is patched, drop inbound requests with Content-Encoding: br at the proxy where your apps do not need them.

Details

• CVE: CVE-2026-111497, out-of-bounds write in the Google Brotli decoder, versions 1.0.3 to 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1. Google rates it 9.2 (CVSS 4.0). Added to CISA KEV October 27, 2026; due November 10, 2026.
• Version check: Node.js cherry-picked the fix without changing the bundled version string, so process.versions.brotli reads 1.2.0 on patched and unpatched builds. Check node --version instead (ELLIO).
• Other fixed releases (ELLIO): Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12; Ruby brotli gem 0.9.1 and 0.9.2; Debian bookworm brotli 1.0.9-2+deb12u1 and trixie 1.1.0-2+deb13u1; Alpine brotli 1.2.1-r0.
• Payload hash (ELLIO): SHA-256 7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b.

Hunt / verify

• Search proxy and load balancer logs for requests from 94.154.43.7 and for very large request bodies sent with Content-Encoding: br.
• Look for clusters of Node.js worker crashes or restarts since October 26; ELLIO found most failed attempts crash the worker.
• Where core dumps are on, check /var/lib/systemd/coredump for recent Node.js cores, limit who can read them, and delete ones you do not need.

Source: ELLIO: exploit traffic and fixed versions; CISA KEV addition

Sources

• ELLIO: Node2Shell, remote code execution on stock Node.js builds (CVE-2026-111497)
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 27, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Help Net Security: Brotli bug reaches far beyond Node.js (CVE-2026-111497)
• Node.js: October 2026 security releases
• Broccoli2Shell cross-ecosystem tracker

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].