Research

Node2Shell (CVE-2026-111497) in active exploitation

Categories: Threat Research Tags: advisory, vulnerability, Node2Shell, Brotli

Read at Sophos X-Ops threat research

EPSS

0.83 (p100)

Exploitation

observed in the wild

• Sophos X-Ops threat research (sophos.com)
• CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 26
   Ubuntu notice Ubuntu 2d ago

   .NET vulnerabilities

   CVE-2026-102870CVE-2026-111497CVE-2026-114148 Canonical
2. 38
   Research Datadog Security Labs 3d ago

   Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

   EPSS 0.83 CVE-2026-111497 Node.js
3. 48
   AWS bulletin AWS 3d ago

   CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

   EPSS 0.83 CVE-2026-111497 Amazon Web Services
4. 38
   Research ThreatLabz 3d ago

   CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

   EPSS 0.83 CVE-2026-111497 Google Node.js
5. 39
   CCCS advisory CCCS 3d ago

   AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497

   EPSS 0.83 CVE-2026-111497 Google
6. 36
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   EPSS 0.83 No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js
7. 53
   Cisco advisory Cisco PSIRT 4d ago

   Vulnerabilities in Node.js Affecting Cisco Products: October 2026

   EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+1 more Cisco Node.js
8. 69
   CISA alert CISA 4d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 0.83 CVE-2026-48356CVE-2026-111497 Google Adobe
9. 42
   Outbreak alert FortiGuard 5d ago

   Node2Shell Remote Code Execution

   EPSS 0.83 CVE-2026-111497 Google Node.js
10. 41
    Tenable research Tenable 5d ago

    Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

    EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
11. 56
    News CyberScoop 5d ago

    Experts temper emergency-level alarms over critical Brotli defect

    Exploited EPSS 0.83 CVE-2026-111497
12. 55
    Threat signal FortiGuard 5d ago

    Node.js Brotli Remote Code Execution (Node2Shell)

    PoC public EPSS 0.83 Fix available CVE-2026-111497 Google Node.js
13. 37
    Palo Alto advisory Palo Alto PSIRT 5d ago

    Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 0.83 CVE-2026-111497 Palo Alto Networks
14. 31
    News The Register 5d ago

    Microsoft releases emergency .NET security fixes for Google Brotli bug

    EPSS 0.83 CVE-2026-111497 Microsoft Google
15. 81
    Research Rapid7 5d ago

    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

    Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js
16. 39
    CCCS advisory CCCS 5d ago

    Google security advisory (AV26-1085)

    EPSS 0.83 CVE-2026-111497 Google
17. 66
    Advisory Fortinet PSIRT 6d ago

    Node2Shell CVEs

    CVSS 9.8 EPSS 0.83 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
18. 31
    Wiz Research Wiz 6d ago

    Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

    EPSS 0.83 CVE-2026-111497
19. 37
    Advisory MSRC 6d ago

    Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

    EPSS 0.83 CVE-2026-111497 Microsoft Google
20. 39
    Qualys TRU Qualys 8d ago

    Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

    EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js