CISA Confirms Active Exploitation of Critical Brotli Vulnerability in Node.js
Known exploited vulnerability adds Node2Shell to CISA KEV catalog; immediate mitigation advised
Key Takeaways
- CISA has confirmed active exploitation of the Node2Shell Brotli vulnerability in Node.js.
- The flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Affected systems run Node.js with Brotli compression enabled.
- Potential impacts include remote code execution and denial of service.
- Organizations should update Node.js to the latest patched version and disable Brotli compression as a mitigation measure.
Quick answers
- What happened?
- The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that threat actors are actively exploiting a critical Brotli compression vulnerability in Node.js, tracked as Node2Shell. The flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, urging organizations to apply mitigations immediately.
- Which products are affected?
- Node.js
- What should defenders do?
- Update Node.js to the latest patched version immediately. Disable Brotli compression if patching is not immediately possible. Monitor official Node.js security advisories and CISA KEV catalog for updates.
On October 28, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability in Node.js. The vulnerability, identified as Node2Shell, is also referenced under the names Broccoli2Shell and HTTP2Shell. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. The flaw affects Node.js deployments with Brotli compression enabled and could allow remote code execution or denial of service conditions. CISA and Node.js maintainers urge organizations to update to the latest patched Node.js versions and disable Brotli compression if immediate patching is not possible. The advisory does not reference a specific CVE identifier in the initial report, but the vulnerability stems from the Brotli compression library integration in Node.js. Users are advised to monitor official Node.js security releases and CISA updates for patch availability and detailed mitigation guidance.
Security Details
Active exploitation of a critical Brotli compression vulnerability in Node.js, tracked as Node2Shell. The flaw affects Node.js deployments with Brotli enabled and could allow remote code execution or denial of service. Added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Affected products
Node.js
Mitigation
Update Node.js to the latest patched version immediately. Disable Brotli compression if patching is not immediately possible. Monitor official Node.js security advisories and CISA KEV catalog for updates.
Sources
BleepingComputer
CISA warns of hackers now exploiting critical Node2Shell flaw
Oct 28, 2026 · 10:46
Original link
Related Security News
Hitachi Energy REB500 Vulnerabilities: Two libexpat Flaws Patched in Version 8.3.4.0
Hitachi Energy has identified two open-source software vulnerabilities affecting the REB500 product line. CVE-2024-8176 is a stack overflow in the libexpat library arising from uncontrolled recursion, and CVE-2025-59375 allows authenticated users to trigger large dynamic memory allocations via crafted XML documents. Both vulnerabilities impact REB500 versions 8.3.3.1 and prior and can result in Denial of Service (DoS). Hitachi Energy has released version 8.3.4.0 containing fixes for both issues.
