A security flaw that sat unnoticed in one of the internet’s most widely used compression libraries for roughly eight months is now being actively exploited, according to several security researchers who began tracking live attack traffic this week.
The vulnerability, tracked as CVE-2026-111497 and nicknamed “Node2Shell” or “Broccoli2Shell” by researchers, sits in the decoder for Brotli, a compression format Google released years ago that is now built into Node.js and bundled with a long list of other software. According to analysis from Help Net Security, the flaw is an out-of-bounds write in the way the decoder handles compressed data, meaning a specially crafted file can corrupt a program’s memory. Depending on the target, that corruption can cause a crash, leak information sitting in memory, or let an attacker run their own code on the affected machine.
Node.js versions 22.x, 24.x, and 26.x are affected, along with the end-of-life 20.x, 23.x, and 25.x branches, which will not get a fix because they are no longer supported. The Node.js project has released patched versions 22.23.4, 24.22.1, and 26.12.1, and the Brotli library itself was updated to versions 1.0.10, 1.1.1, and 1.2.1 last week. Node.js is far from the only software that bundles Brotli, though. Security firm Tenable has said any application that decompresses Brotli data supplied by an untrusted source could be at risk, and pointed to .NET, Bun, Envoy Proxy, Istio, several Python HTTP libraries, FFmpeg, Apache Arrow, and ClickHouse as examples. Actual exposure still depends on whether each specific application feeds attacker-controlled data through the vulnerable decoder.
What makes the timeline unusual is how long the fix sat in plain sight before anyone raised an alarm about it. The patch was quietly committed to Google’s open-source Brotli code repository on February 27, 2026, without an accompanying security advisory or release, according to Help Net Security’s reporting. It took roughly eight months for the issue to be flagged as a security vulnerability, with Node.js publicly disclosing the flaw on October 21.
Exploitation followed quickly once the disclosure went public. Threat intelligence firm ELLIO reported recording exploit traffic from the IP address 94.154.43.7 starting around October 26, the same address it had previously linked to exploitation of PHP2Shell, an unrelated critical PHP vulnerability patched earlier this month, as well as to scanning for exposed VPNs and Kubernetes clusters. ELLIO said the pattern pointed to an operator focused on mass exploitation rather than a narrowly targeted attack. Researchers at Imperva separately demonstrated full remote code execution against an official Node.js Docker image, and proof-of-concept exploit code has since been published on GitHub, lowering the bar for less skilled attackers to join in.
Security vendor Aikido has advised affected organizations to update their dependency locks to the patched versions, rebuild any application or container image that bundles the vulnerable Brotli code, and redeploy and restart affected services, rather than assuming a simple library version bump is enough on its own. Because Brotli decoding happens deep inside many layers of modern software, from web servers to proxies to data processing tools, organizations may need to check dependencies they do not directly maintain to be sure they are no longer exposed.
No CVSS score was cited in the reporting reviewed for this story, though researchers at multiple firms, including Rapid7 and Tenable, have described the flaw as critical given how widely Brotli decoding is used to process data arriving from untrusted sources across the open internet.
Source: Help Net Security, “Brotli bug reaches far beyond Node.js (CVE-2026-111497),” October 27, 2026.
 is under active exploitation, putting Node.js and many other tools that decompress untrusted data at risk.){kind=link}