CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog on 27 October, and the pairing says almost everything about how quickly a library bug becomes an operational emergency: one is an out-of-bounds write in Google's Brotli decoder, the other an unrestricted file upload in Adobe Commerce and Magento. Federal civilian agencies have until 10 November to patch. Everyone else should move faster.

The decoder, not the runtime

CVE-2026-111497 (CVSS 9.2) was disclosed in Node.js's 21 October security release. The root cause, as JFrog's researchers describe it, is an error-handling flaw in the decoder's block-switch processing: an invalid block switch is treated as a request for more input, so decoding continues with invalid state and writes past the end of the intended buffer. The result can be a crash, disclosure of process memory, or — in narrow configurations — remote code execution.

The naming tells the story of the week. Imperva demonstrated RCE against a vulnerable Node.js build on 22 October and called it Node2Shell. A day later, as evidence emerged that the flaw was not Node-specific, researchers renamed it HTTP2Shell. By the weekend it was Broccoli2Shell, because the vulnerable code sits in the Brotli decoder that dozens of ecosystems link or bundle. It was never a Node.js bug.

Reported credit goes to Khai Tran and Sylvie Mayer of OpenAI Codex Security.

Where it actually reaches

Fixed versions: Node.js 22.23.4, 24.22.1 and 26.12.1; upstream Brotli 1.0.10, 1.1.1 and 1.2.1. Downstream, the list keeps growing: PHP 8.2.35-1 through 8.5.12-1, Bun, .NET, Envoy Proxy, Istio, Python's brotli and brotlicffi packages, the Ruby brotli gem, ClickHouse, Apache Arrow, plus distributions and appliances from Red Hat, Ubuntu, Cisco, Fortinet, F5, Palo Alto Networks and others.

JFrog's write-up is the useful corrective to version-only scanning. Its researchers reached the decoder through paths with no HTTP involved at all: a crafted JPEG XL file, where libjxl decompresses Brotli metadata inside the brob box, gives FFmpeg memory corruption and instruction-pointer control (0x414141414141 in their test); a 23 MB request body sent with Content-Encoding: br segfaults ClickHouse during cleanup; a 534-byte Parquet payload sends pyarrow into an infinite loop. Brotli arrives through transitive dependencies, system libraries and bundled copies — which makes an SBOM line reading "brotli 1.1.0" a starting point, not an answer.

The exposure estimates are what make this urgent. Wiz puts it at 91% of cloud environments containing resources vulnerable to CVE-2026-111497, with 82% running publicly exposed Node.js instances. Sysdig's framing is the right one for patch planning: this is not a bug in every Node.js service, but in services that decode attacker-influenced Brotli — and Express 5's default JSON parsing puts a large number of them in that group.

Exploitation is not theoretical

ELLIO reported sensors recording exploit traffic carrying a working Node2Shell exploit for Node v24.22.0, from an IP geolocated to the Netherlands that has also attacked PHP2Shell. Previdian logged a honeypot attempt from a US address on 27 October. Imperva, JFrog and others have all demonstrated code execution, not merely crashes.

The other half of the KEV entry is older and quieter. CVE-2026-48356 (CVSS 9.3) is the Magento and Adobe Commerce unrestricted upload that Sansec tracks as PolyShell. Adobe fixed it in July; Sansec says a single actor has used it — often chained with SessionReaper, CVE-2025-54236 — to compromise 953 storefronts since July 2025, planting a loader in Magento CMS blocks that tells scanners and real shoppers apart and serves the payload only to the latter. No second-stage payload has been recovered, so the campaign's goal remains unclear. That is not reassuring.

The tempo problem

Rapid7's third-quarter threat report, out this week, puts the median lag from disclosure to first exploitation attempt at three days, with 71% of observed exploit attempts landing inside the first week. A 9.2 in a compression library that ships inside everything, with a public exploit, fits that curve exactly. The patch window is not the CISA deadline. It is the weekend.

What to do, in order: find services that decode untrusted Brotli (request bodies, fetch() response decompression, JPEG XL and Parquet paths, .NET BrotliStream); upgrade the runtime or library; check for bundled copies your scanner cannot see; and treat any internet-facing Node service that has been decoding Brotli since 21 October as potentially compromised rather than merely unpatched.

Sources