CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

The Node2Shell vulnerability (CVE-2026-111497) in Brotli compression library versions 1.0.3 through 1.2.0 allows arbitrary code execution and is already being actively exploited in the wild, with honeypots confirming real-world attack attempts. CISA's addition to the Known Exploited Vulnerabilities catalog signals that threat actors are capitalizing on the window between vulnerability disclosure and patching. Even a broken exploit variant poses a denial-of-service risk, meaning unpatched organizations face multiple threat vectors simultaneously. This incident underscores how widely embedded open-source libraries can create sprawling, often invisible attack surfaces if not tracked and patched promptly.