Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Multiple Security Vendors Release Security Updates for Node2Shell Vulnerability (CVE-2026-111497)

Successful exploitation could lead to memory disclosure, denial-of-service (DoS), or remote code execution (RCE)

Threat ID:
CC-4882
Threat Severity:
Medium
Published:
29 October 2026 1:07 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation could lead to memory disclosure, denial-of-service (DoS), or remote code execution (RCE)

Threat details

Active Exploitation of CVE-2026-111497

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-111497 vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

Security researchers have reported successful code execution against Node.js 24.22.0, requiring multiple attempts, alongside reports of active exploitation attempts. 

The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

On October 21, 2026, the Node.js project disclosed CVE-2026-111497 in Google’s Brotli decoder used by Node.js and other software. The vulnerability is widely known as Node2Shell, Broccoli2Shell and HTTP2Shell. 

CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder, with a CVSSv4 score of 9.2. Successful exploitation could lead to memory disclosure, denial-of-service (DoS), or remote code execution (RCE).

Numerous security vendors including Palo Alto Networks, Cisco, Fortinet, Microsoft have published advisories or security updates addressing CVE-2026-111497 vulnerability. 

NHS England National CSOC previously addressed CVE-2026-111497 in Cyber Alert CC-4881. In response to active exploitation and multiple vendor advisories, this update provides the additional guidance on CVE-2026-111497. 

Note: The list of vendors provided is non-exhaustive. Organisations should review their relevant vendors for the latest security updates and guidance.

Remediation advice

Affected organisations are encouraged to review the vendor advisories and apply the relevant updates as soon as possible.

Last edited: 29 October 2026 1:07 pm