US cybersecurity agency sets November 10 deadline to fix exploited Node.js flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, citing evidence of active exploitation. Federal civilian executive branch agencies must apply fixes by November 10, The Hacker News said.

The listing follows security updates released by the Node.js project on October 21, the same day public exploit code appeared, MyCERT says. The flaw affects Google’s Brotli compression library bundled with Node.js. Exposure depends on an application or one of its libraries decompressing attacker-controlled Brotli data—not simply on running Node.js.

What the exploit traffic shows

Threat intelligence firm Previdian recorded one exploitation attempt against its honeypots—decoy systems used to observe attacks—as of October 27. The attempt came from a US-based IP address.

ELLIO said on October 26 that its sensors had detected exploit traffic from an IP address geolocated to the Netherlands. It described the payload as a correctly structured attempt targeting Node.js 24.22.0 and matching the public exploit. ELLIO also said it had validated that the public exploit could obtain a shell, a command interface, on vulnerable builds.

These sensor observations establish exploitation attempts, not successful compromises of victims. The campaign’s scale remains unknown. Sysdig describes the demonstrated effects so far as crashes at scale and code execution in a narrow configuration.

Which application paths are exposed

Node.js rates the flaw as high severity. Malformed compressed input can make the decoder write beyond an internal buffer and corrupt the application’s memory. Node.js says this can crash the process, disclose sensitive memory contents or allow an attacker to run code remotely.