Node2Shell: What Business Owners Should Do About the Brotli Flaw

On October 27, 2026, CISA added a flaw nicknamed Node2Shell to its list of vulnerabilities known to be exploited in real attacks. Tracked as CVE-2026-111497, it sits in Brotli, a data compression library from Google that many websites, apps and devices use to make web traffic smaller. With specially crafted compressed data, an attacker who does not need a password could crash the software, read parts of its memory, or potentially run their own code on it. It is rated 9.2 out of 10 for severity.

Coming right after PHP2Shell, this is the second widely used building block of the web to need urgent patching this month. The fixes are already out, so for most businesses this is a matter of making sure updates actually get applied.

The short version: ask whoever runs your websites, apps and firewall whether they use Brotli or Node.js, and make sure they are on fixed versions. If you have a Palo Alto Networks firewall, check one setting today.

What Node2Shell is

Brotli versions 1.0.3 through 1.2.0 can mishandle a malformed compressed stream and write past the end of a small internal buffer. Software that unpacks Brotli data from an untrusted source can be attacked this way. Node.js, the popular platform for running JavaScript on servers, bundles this decoder, which is where the name comes from, but any program that includes the same Brotli code is affected.

Who is at risk

• Websites and apps built on Node.js. Node.js versions in the 22, 24 and 26 lines before the October 21 fixes are affected, and versions that are no longer supported, such as Node.js 20, will not get a fix.
• Some Palo Alto Networks firewalls. PA-Series and VM-Series firewalls on PAN-OS 11.2.4 or later are affected only if inspection of Brotli traffic and TLS/SSL decryption are both turned on. Brotli inspection is off by default. PAN-OS 11.1 and 10.2 are not affected, and Palo Alto says the management interface is not affected.
• Other software that bundles Brotli. SecurityWeek reports that Microsoft, Bun, Envoy, Istio and the maintainers of two Python packages have released fixes, so check with your vendors for anything that handles web traffic.

How to fix it

Node.js: update to 22.23.4, 24.22.1 or 26.12.1 or later. The Node.js project offers no workaround, so updating is the fix. Anything on an unsupported Node.js version needs to move to a supported one.

Brotli itself: update to 1.0.10, 1.1.1 or 1.2.1.

Palo Alto firewalls: from the firewall's command line, run show system setting brotli. You are only exposed if it shows Enabled: yes. If it does, install the fixed PAN-OS hotfix for your version as listed in Palo Alto's advisory (some hotfixes are scheduled for October 29 and 30), or turn Brotli inspection off with set system setting brotli-encoding disable until you can update.

Why this week matters

CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. According to SecurityWeek, two security firms recorded exploitation attempts against their monitoring sensors around October 26 and 27, and one says the attempt came from an address previously seen probing Palo Alto Networks and Fortinet VPN devices. Even failed attempts can crash the targeted software, so unpatched systems can also be knocked offline.

Questions to ask this week

1. Do any of our websites, customer portals or internal tools run on Node.js, and are they on a fixed version?
2. Is anything still on an unsupported Node.js version, and what is the plan for it?
3. If we have a Palo Alto firewall, is Brotli inspection turned on, and if so, when will the fixed hotfix be installed?
4. Have our other vendors, such as web hosts and software providers, confirmed they have applied the Brotli fix?