The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, the Brotli decoder flaw also known as HTTP2Shell and Node2Shell, to its Known Exploited Vulnerabilities catalog on October 27, 2026. A listing there means CISA has evidence of real attacks. We covered the fixes when they shipped in our first brief on HTTP2Shell, and this is the follow-up for anyone who put the update off.

What’s new

  • CISA’s catalog entry says a remote attacker with no login can send a crafted Brotli-compressed stream to corrupt decoder memory, leak memory contents, crash the service or possibly run code.
  • Federal agencies must patch by November 10, 2026. BleepingComputer reported that CISA urged all network defenders to treat the flaw as a priority.
  • The fix is in Brotli 1.2.1, published on GitHub on October 21. The Node.js security advisory says apps that decompress Brotli data with node:zlib on the 26.x, 24.x and 22.x lines are exposed until updated.
  • BleepingComputer also reported that Microsoft pushed an emergency .NET update for the same flaw.

Who it affects

For a typical WordPress site on managed hosting, the exposure sits mostly with your host’s servers, proxies and CDN, so the check starts with them. The risk is sharper for businesses that run their own Node.js apps, Next.js front ends, .NET services, API servers or containers, since those often bundle their own copy of the Brotli library.

If an agency or freelancer built a custom app, booking tool or headless store for you, it may be running on one of those stacks without you knowing. Ask them directly.

Our take

Treat this as this week’s job. Ask your host to confirm in writing that its servers and CDN edge run patched Brotli builds. If you run Node.js or .NET yourself, install the patched release, restart the processes and rebuild any container images, a step BleepingComputer says can’t be skipped. If you can’t patch today, the same report suggests blocking Brotli-compressed requests at the proxy or firewall, or turning off Brotli decoding until you can.

Want a second pair of eyes on a custom app or server? Our website maintenance service covers patching and server checks, and our Next.js developers can review Node-based front ends. Start with a free audit.