One Bug, Five Names, and CISA Filed It Under None of Them. Node2Shell Is on the Must-Patch List as 'Google Brotli' and Your Inventory Search Will Miss It.
CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog yesterday, October 27, with a remediation deadline of November 10 under Binding Operational Directive 26-04.
You have probably read about this flaw already. You have probably not read about it under the name CISA used.
The catalog entry is filed under vendor Google, product Brotli, titled "Google Brotli Unchecked Return Value Vulnerability." Every vendor write-up published in the preceding six days calls it something else. If your patch process starts by pulling KEV and filtering it against an asset inventory that lists Node.js, this row does not match anything you own, and the deadline passes without the ticket ever opening.
Five names, one out-of-bounds write
The bug itself is narrow and old-fashioned: an unchecked return value in Google's Brotli decoder leading to an out-of-bounds write, CWE-252 and CWE-787 on the catalog entry. Google, as the CVE numbering authority, scored it 9.2 critical under CVSS 4.0. The Node.js project rates it High.
A crafted Brotli-compressed stream corrupts adjacent decoder state. CISA's own description lists the consequences in order of increasing unpleasantness: disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. Researchers at Imperva and Aikido reproduced code execution on an unmodified Node.js 24.22.0 build in lab conditions, and were candid that it did not work on every attempt.
The reason it has five names is that the bug is not in any of the products named after it. It is in a compression library that those products bundle. Node.js inherited it. Bun inherited it. Python packages carrying their own copy of the decoder inherited it. Each community wrote it up, each named it after itself, and the names stuck in parallel rather than converging.
So the industry produced Node2Shell, which Akamai, Aikido, Imperva, Sysdig, Cycode and The Hacker News all use and which is now the dominant name. Then HTTP2Shell, once it became clear non-Node libraries were affected, which has the unfortunate property of reading like an HTTP/2 protocol vulnerability to anyone triaging a queue at speed. Then Broccoli2Shell, which is a good joke and a terrible search term. Then Python2Shell for the Python side, which misses exactly the estate the first name covers.
And then CISA, which used none of them.
This is an operational problem, not a pedantic one
Naming fragmentation is usually a complaint about aesthetics. Here it has a date attached.
Vulnerability management at most organizations is a join. One side is a catalog of flaws, increasingly KEV because a federal directive made it the floor. The other side is an inventory of what you run. The join key is whatever string both sides happen to use. When the catalog says "Google Brotli" and the inventory says "Node.js 22.19.0," there is no key, and the row falls on the floor silently. Nothing errors. The report comes back green with one fewer line in it than it should have.
The inverse failure is just as live. A team that heard "Node2Shell" and patched every Node host can reasonably believe it is finished, while the Python services that bundle their own decoder copy sit untouched, because the name they were given pointed at the wrong inventory.
The only identifier that survives every one of these translations is the CVE. That is what it is for. Search by CVE-2026-111497, not by any nickname, and reconcile your KEV join on CVE identifier rather than product string.
We got this wrong ourselves this morning in the direction that matters least but illustrates the point: a correlation check matched "HTTP2Shell" against our own earlier Brotli coverage, found no shared words between the two names, and concluded they were different bugs. They were the same bug. A string match cannot see through a nickname, and neither can a person reading quickly.
What to actually do
The fix is a version number, which is the one thing that does not fragment.
Node.js 22.23.4, 24.22.1 or 26.12.1, shipped October 21. Upstream, Brotli v1.2.1. If you are on Node 20, 23 or 25, those lines are end of life and there is no patch coming for them — moving to a supported line is the patch, and that is a larger piece of work than a point upgrade, which is why it is worth starting before November 10 rather than on it.
You are exposed wherever your code decompresses Brotli data you did not create. The two paths most people have without realizing it are a plain fetch of an untrusted URL using Node's built-in client, and an Express 5 request body. Neither looks like compression code when you read it. Wiz's measurement put vulnerable resources in 91 percent of cloud environments, which sounds like marketing until you remember that the exposure is a transitive dependency of a dependency.
If you cannot patch immediately, Imperva has published WAF rules, and Theori suggested reverse-proxy level blocking as a stopgap. Treat both as a delay, not a remedy.
Two more deadlines this week, one of them tomorrow
Since KEV is the clock now, the rest of this week's additions are worth stating plainly.
CVE-2026-109618 and CVE-2026-109619, the two PHP remote code execution flaws behind the exploit tool called PHP2Shell, were added on October 26 with a due date of October 29. That is tomorrow. Both are unauthenticated RCE against anything running PHP that answers web requests. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or your distribution's package.
CVE-2026-48356 in Adobe Commerce and Magento was added October 27 alongside the Brotli entry.
On the PHP pair we published the patch list on October 21, the day the fixes shipped, five days before CISA listed them, and again on October 23 when the campaign picked up a Mirai payload. We are not calling that a detection lead and it would be dishonest to: PHP disclosed its own flaws, and the exploit details leaked publicly before the fix. What it means is narrower and still useful — a defender reading us had the patch list and the indicators five days before the federal must-patch order arrived. Same story on the Brotli bug, which we covered on October 22, five days before it reached KEV. Our timestamp and the comparator's, side by side, with no claim between them.
Unrelated, blockable, and free
One more from this week that costs nothing to act on. Checkmarx published the MALFEX npm campaign — eight malicious packages, 40,767 downloads, delivering a remote access trojan and an infostealer.
Three of them were still installable at the time of writing: function-flag, function-color and cdn-img-fetch. All three return a block verdict from our free package check, carrying OSV identifiers MAL-2026-17648, MAL-2026-17647 and MAL-2026-17320 respectively. We verified those three verdicts live today rather than quoting the campaign write-up.
We did not discover any of them. OSV published the identifiers and we carry them, which is distribution value to anyone who is not paying for a commercial feed, and nothing more than that. Calling it a find would be laundering somebody else's research under our name.
The shape of it
A bug in a compression library picked up four nicknames in six days, and the authority that attached a legal deadline to it used a fifth. None of the five is wrong. All of them are true names for the same out-of-bounds write. And a defender holding any one of them, searching an inventory that uses a different one, gets an empty result set that looks exactly like being safe.
Reconcile on the CVE. It is the only string nobody got creative with.
Catalog facts read from CISA's own Known Exploited Vulnerabilities feed on October 28, 2026, at 1,760 entries — dates, due dates and the catalog's vulnerability names are first-party reads of that artifact, not quoted from coverage. Package verdicts checked live the same day. Severity scores, naming attributions, the lab reproduction and the exposure measurement are credited to the vendors and researchers named above and are their observations, not ours. We cap ourselves at 95 percent confidence, because something in any list this long is wrong.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments