Brotli is on KEV. A Node bump is not the copy in .NET.

CISA added CVE-2026-111497 on 27 October. Due 10 November. Catalog 2026.10.27 / 1760. The row is Google Brotli. Every decoder that still inflates attacker-controlled br is the asset.

RWP Ventures · 2026-10-28 · event 2026-10-27 · 12 min read · priority 9.2

Do not collapse five facts.

1. The overnight increment is KEV, not first disclosure. Node.js shipped 22.23.4 / 24.22.1 / 26.12.1 on 21 October. Google’s fixed trains are 1.0.10 / 1.1.1 / 1.2.1. Microsoft’s .NET out-of-band (8.0.33 / 9.0.22 / 10.0.14 / 11 RC3) landed 25 October. PHP rebuilt Windows packages as 8.5.12-1 / 8.4.27-1 / 8.3.36-1 / 8.2.35-1 on 26 October. [Yesterday’s Daily Top](/posts/2026-10-27-php2shell-kev-due-thursday/) recorded catalog 2026.10.26 / 1758 with this CVE off KEV. Tuesday night’s listing is the federal clock.
2. A Node bump is not the copy in .NET, PHP, or PAN-OS. CISA listed Google Brotli, not Node.js. process.versions.brotli can still read 1.2.0 on a patched Node build because the project cherry-picked the fix without bumping the bundled string. Self-contained .NET apps and containers keep their own runtime until you rebuild. The PHP -1 suffix is a Windows package rebuild, not php-src. Palo Alto’s PAN-OS path is a hotfix (and, for most 11.2/12.x trains, the same hotfix as PHP2Shell).
3. Forensic triage is No. Unlike [PHP2Shell](/posts/2026-10-27-php2shell-kev-due-thursday/) (due tomorrow, forensic triage Yes), this row does not carry the BOD 26-04 pre-patch compromise flag. That is a catalog field, not a reason to skip hunting a process that already decoded attacker br.
4. The sibling 27 October row is Magento, not this decoder. CVE-2026-48356 (Adobe Commerce / Magento, PolyShell, CWE-434) was added in the same alert, same due date, also forensic triage No. Adobe’s APSB26-73 shipped 14 July. Do not close a store hunt on a Node.js ticket, or a Brotli hunt on a Magento ticket.
5. A firewall product notice is not confirmed process impact. Palo Alto’s portfolio note (updated 28 October) lists PAN-OS 12.2 / 12.1 / 11.2 when Brotli inspection and TLS decryption are on the dataplane. 11.1 and 10.2 are not affected. Panorama is not affected. Palo Alto is not aware of malicious exploitation of this issue in its products. That is a product notice. It is not evidence a PLC, safety system, or physical process was hit.

The operator sentence: inventory every place a process inflates attacker-controlled Brotli — Node node:zlib, Express 5 / body-parser 2, .NET request or HttpClient decompression, Python brotli bindings, Envoy, Bun, PHP Windows cURL, PAN-OS Brotli inspection — then patch that copy. A Node 24.22.1 string does not patch 8.0.32.

What happened

CISA’s 27 October KEV alert is two rows.

Those are the only two additions in catalog 2026.10.27. Prior newest rows remain PHP2Shell CVE-2026-109618 / 109619, added 26 October, due 29 October, forensic triage Yes.

The exploitation evidence CISA did not republish in the KEV alert. Independent reporting fills the gap between “PoC” and “listed”:

• 21 October. Node.js advisory: invalid block switch reported as need-more-input instead of a format error; streaming decoder kept appending into an eight-byte internal buffer. Credit: OpenAI Codex Security (Khai Tran, Sylvie Mayer). Fixed Node trains: 22.23.4, 24.22.1, 26.12.1. Google Brotli releases 1.0.10 / 1.1.1 / 1.2.1 the same week.
• 22–25 October. Imperva showed code execution on an official Node.js 24.22.0 Linux arm64 image. ELLIO reproduced shells on x86-64 against stock node:http, node:24.22.0-slim, Express 5.3.0, and Koa 3. Microsoft OOB .NET 25 October.
• 26 October. ELLIO sensors recorded exploit traffic carrying the public Node2Shell payload. PHP Windows rebuilds. Palo Alto published the PAN-OS portfolio note. Rapid7, same day: not on KEV, not aware of in-the-wild use.
• 26 October, Microsoft SUG (last updated that day): publicly disclosed Yes, exploited No, exploitability Exploitation More Likely. .NET Framework not affected. Request decompression and HttpClient automatic decompression off by default.
• 27 October, 19:00 UTC. CISA catalog 2026.10.27 / 1760. Both CVEs on KEV.

The Hacker News (28 October) independently reported the listing, Sansec’s Magento campaign as the context for 48356, and Previdian’s one Brotli exploitation attempt against a honeypot from a U.S. IP as of 27 October. CISA has not published a victim census, actor name, or ransomware overlay with the add.

Why it matters

Three operational reasons this is the daily.

First, the federal clock is on a library, not a named app. FCEB agencies have until 10 November. BOD 26-04 still wants internet-facing, total-control KEVs treated as priority even when forensic triage is No. The asset register that only lists “Node.js servers” will miss self-contained .NET, Python wheels, Envoy sidecars, Bun compiles, PHP Windows cURL, and PAN-OS dataplane inspection.

Second, the false close is a version string. Node.js cherry-picked Google commit 0ed4268a without bumping the bundled Brotli number, so process.versions.brotli is not the patch check — node -v against 22.23.4 / 24.22.1 / 26.12.1 is. Microsoft: installing a newer host runtime does not update a self-contained app or a container image. PHP: 8.4.27 without the -1 Windows rebuild still carries the old decoder. Debian-style Node that links system libbrotli is a package bump, not a Node bump.

Third, reachability is the decoder, not the presence of Node. Rapid7: an attacker who can supply Brotli data that the app decompresses with node:zlib can corrupt process memory. A bare node:http server does not inflate Content-Encoding: br just by receiving it. Express 5 express.json() / express.raw(), body-parser 2, Koa body parsers, undici/fetch() on a br response, and explicit node:zlib calls do. .NET is in the same shape: ASP.NET Core request decompression and HttpClient automatic decompression are opt-in.

Who / what is affected

• Google Brotli 1.0.3 through 1.2.0 on all platforms. Fixed: 1.0.10, 1.1.1, 1.2.1.
• Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1. EOL 20.x / 23.x / 25.x: no project fix; move to a supported line.
• .NET 8 / 9 / 10 / 11 RC that process Brotli through request decompression, HttpClient automatic decompression, or System.IO.Compression Brotli APIs. Floors: 8.0.33, 9.0.22, 10.0.14, 11 RC3. Visual Studio and PowerShell 7.4/7.5/7.6 were in the same Microsoft wave. .NET Framework is not affected.
• PHP official Windows builds via the cURL extension when automatic HTTP response decompression is enabled (off by default in cURL). Floors: 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1. Same PHP source; the -1 is the dependency rebuild.
• PAN-OS 12.2, 12.1, 11.2 with Brotli inspection and TLS/SSL decryption on the dataplane. Check: show system setting brotli. Workaround until the hotfix: disable Brotli encoding. 11.1, 10.2, Panorama: not affected. Prisma Cloud Application Security Transporter Client: 0.2.9. Several Palo Alto SaaS products are vendor-managed.
• Other named copies (not a complete census): Bun, PyPI Brotli / brotlicffi, Envoy, Istio, the Ruby brotli gem, F5, Fortinet, Cisco’s Node.js advisory. Patch the product PSIRT, not nodejs.org, for appliances.
• Not this KEV row: [PHP2Shell CVE-2026-109618 / 109619](/posts/2026-10-27-php2shell-kev-due-thursday/) (interpreter, due 29 October, forensic triage Yes). Magento CVE-2026-48356 (same catalog add, different product). PHP informational CVE-2026-115560.

Technical context

High-level, from the Node.js advisory and the KEV short description. This is not an exploit recipe.

Brotli streams are metablocks of typed blocks. When a block-type counter hits zero, the decoder reads a block switch. An invalid switch — including a switch when only one block type exists — should be a permanent format error. The helper returned a boolean. False meant both “invalid switch” and “need more input.” Callers sent more bytes. The decoder kept unconsumed input in an eight-byte internal buffer. The invalid path never drained it. Writes past the eighth byte landed outside the buffer (CWE-252 → CWE-787).

The fix gives the helper its own error code (BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH) so an invalid switch stops instead of asking for more input. Google committed that change in February 2026; stable Brotli releases with the fix shipped the week of 21 October.

ATT&CK (defensive mapping, not attribution): T1190 exploit public-facing application, where the application decompresses attacker-controlled br. Follow-on webshells, miners, or ransomware in production: UNKNOWN in this retrieval. CISA’s ransomware field is Unknown.

Threat / exploitation status

What defenders should do

1. Inventory decoders, not “the Node estate.” Anywhere a process inflates Content-Encoding: br or calls a Brotli API on untrusted bytes: Node services (especially Express 5 / body-parser 2 / undici fetch), self-contained .NET and containers, Python HTTP clients with brotli/brotlicffi, Envoy/Istio, Bun compiles, PHP Windows with cURL auto-decompress, PAN-OS with Brotli inspection on.
2. Patch the copy, then restart or rebuild. Node: 22.23.4, 24.22.1, 26.12.1 — check node -v, not process.versions.brotli. .NET: install 8.0.33 / 9.0.22 / 10.0.14 / 11 RC3 for framework-dependent apps; rebuild self-contained apps and container images. PHP Windows: the -1 packages. System libbrotli: the distro advisory. PAN-OS: the hotfix in Palo Alto’s table; until then, disable Brotli encoding (set system setting brotli-encoding disable). Same PAN-OS hotfix generally covers PHP2Shell; exception called out by Palo Alto: 11.2.10-h16 is PHP-only, 11.2.10-h17 is both.
3. Do not treat Microsoft’s 26 October “Exploited: No” as the close. That SUG row predates catalog 2026.10.27. CISA listed the library. The .NET copy is still the library.
4. Hunt where you already decoded br from the internet, even though forensic triage is No. Worker crashes on Brotli bodies, unexplained restarts, cores under systemd-coredump, unexpected children of the Node/.NET/Python worker. A crash is availability and, where cores are kept, a memory-disclosure incident. This is hygiene on a KEV decoder, not a confirmed-compromise assertion for every host.
5. Keep the Magento row on its own ticket. CVE-2026-48356 is APSB26-73 (2.4.x-2026-jul trains). Sansec’s PolyShell/CMS-block campaign is store compromise. A Brotli Node bump does not patch Magento; a Magento July patch does not patch Brotli.
6. Do not close PHP2Shell on this row. Both PHP2Shell CVEs are still due Thursday 29 October, forensic triage Yes. Windows PHP -1 is Brotli. php-src 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 is PHP2Shell. You may need both.
7. Federal / BOD 26-04 clock: 111497 and 48356 due 10 November. PHP2Shell due tomorrow. Collabora 110447 and Arista 114625 were due 26 October. Those clocks did not pause.
8. Do not merge adjacent bugs onto this row. PHP informational CVE-2026-115560. FortiSandbox CVE-2026-107656 was not in catalog 2026.10.27.

RWP is not publishing exploit code, PoC repositories, or a how-to for the block-switch path.

RWP assessment

High confidence that CISA listed CVE-2026-111497 on 27 October, that catalog 2026.10.27 / 1760 is the current feed, that the row is due 10 November with forensic triage No, and that Node 22.23.4 / 24.22.1 / 26.12.1, Brotli 1.0.10 / 1.1.1 / 1.2.1, and .NET 8.0.33 / 9.0.22 / 10.0.14 remain the documented closes for those copies.

High confidence that updating Node.js without rebuilding self-contained .NET, replacing PHP Windows packages, or taking the PAN-OS hotfix does not remediate those copies, and that this listing is a material increment on yesterday’s Daily Top, which recorded 111497 off KEV.

Moderate confidence in successful in-the-wild RCE beyond sensors. CISA’s KEV criteria require evidence of exploitation; that is the federal confirmation. ELLIO’s 26 October sensor traffic and Imperva/ELLIO lab shells are independent technical reporting. Previdian’s single attempt is a sensor, not a breach ledger. Palo Alto and Microsoft (as of 26 October) still said they were not aware of exploitation of their copies.

Low confidence in actor identity and in any ransomware overlay. KEV field is Unknown. None is in the current record.

Confidence that this is not OT process impact: high. Palo Alto published a PAN-OS product notice with a configuration precondition (Brotli inspection + decryption). No evidence in this retrieval that a controller, safety system, or physical process was affected.

This outranked Magento CVE-2026-48356 (same catalog add, narrower product, July patch already shipping, store campaign is real but not the decoder), PHP2Shell’s Thursday clock (already the 27 October Daily Top; no new catalog increment), CISA ICS notes on EPICS Base and Mitsubishi GENESIS/ICONICS (no known exploitation), and FortiSandbox CVE-2026-107656 (still off this catalog).

What we are watching

• A confirmed production victim, a named payload, or CISA IOCs attached to 111497. Ransomware field is still Unknown.
• Microsoft SUG flipping from “Exploited: No” now that the library is on KEV.
• Distro and appliance floors that still ship affected Brotli under old Node or package numbers, including PAN-OS trains still marked ETA.
• Whether Magento CVE-2026-48356 grows a forensic-triage flag or a ransomware overlay.
• PHP2Shell due 29 October. Separate ticket.
• FortiSandbox CVE-2026-107656 if PSIRT or CISA flips exploitation status.

Sources

Primary: CISA 27 October KEV add alert; CISA KEV JSON catalog 2026.10.27 / 1760; Node.js 21 October security release and 22.23.4 notes; Google Brotli v1.2.1; NVD/CVE-2026-111497; Microsoft .NET OOB 25 October and SUG last updated 26 October; Palo Alto CVE-2026-111497 note updated 28 October; PHP 26 October Windows rebuilds; Adobe APSB26-73; BOD 26-04 implementation guidance. Independent: Rapid7 26–27 October; The Hacker News 28 October; ELLIO 25–26 October. Prior RWP: PHP2Shell KEV Daily Top 27 October; PHP2Shell Daily Top 22 October; weekly IT 26 October.