Outbreak Alert: Node2Shell Remote Code Execution

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence.

Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets.

The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.

CVE ID

CVE-2026-111497

CVE Title

Google Brotli Unchecked Return Value Vulnerability

NVD Severity

CRITICAL

FortiRecon Severity

CRITICAL

FortiRecon Score

95/100

Epss Score

0.55483

Exploited

Yes

Exploited by Ransomware Group(s)

No

Exploited by APT Group(s)

Yes (Unknown (North Korea))

Included in CISA KEV List

Yes

Available working exploit(s)

0

Available POC exploit(s)

71

Darknet Mention(s)

2 (ufolabs, crdclub)

Telegram Mention(s)

1 (🔪 That Dark Web Guy - Part 3 🔪)

FortiRecon Intelligence Reporting(s)

7 (OSINT), 1 (Darknet), 1 (FortiGuard Research)

Vendor Advisory:

• http://www.openwall.com/lists/oss-security/2026/10/26/13

• https://github.com/google/brotli/releases/tag/v1.1.1

• http://www.openwall.com/lists/oss-security/2026/10/26/12

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497

• https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html

• https://patchtheplanet.org/brotli

• https://github.com/google/brotli/releases/tag/v1.2.1

• https://github.com/dotnet/announcements/issues/494

• http://www.openwall.com/lists/oss-security/2026/10/23/25

• https://github.com/andybalholm/brotli/releases/tag/v1.2.7

• http://www.openwall.com/lists/oss-security/2026/10/26/16

• http://www.openwall.com/lists/oss-security/2026/10/24/6

• https://github.com/google/brotli/releases/tag/v1.0.10

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

• https://github.com/advisories/GHSA-9v8h-qqgm-4m35

• https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/

• https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

• https://broccoli2shell.com