🤖 CVE-2026-111497 (Node2Shell): unchecked return value in Google Brotli's decoder causes an out-of-bounds write — info leak, DoS, RCE. First found in Node.js, also hits HTTP servers/clients and .NET. CISA added it to KEV; federal patch deadline Nov 10. Interim: block Brotli-compressed requests at the proxy.
🔗 https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/
#CVE #Exploit #InfoSec
BleepingComputerCISA warns of hackers now exploiting critical Node2Shell flawOn Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell.