Threat reportVulnerabilityTL-2026-4637
CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell) and Adobe Commerce/Magento (CVE-2026-48356, PolyShell) flaws
CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell) (TL-2026-4637), also tracked as Node2Shell, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-10-28. It has no confirmed attribution, affects Node.js Node.js, references 2 CVEs (CVE-2026-111497, CVE-2026-48356), maps to 10 MITRE ATT&CK techniques (T1027, T1036.008, T1059), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4637
- Threat ID
- TL-2026-4637
- Also known as
- Node2Shell, HTTP2Shell, PolyShell
- Severity
- CRITICAL
- CVSS
- 9.3
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- retail, ecommerce, technology, cloud services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
Malware and tooling: PHP
How CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell) works
CISA added two actively exploited flaws to its KEV catalog: an unchecked-return-value / out-of-bounds write bug in the Google Brotli decoder (CVE-2026-111497, 'Node2Shell', CVSS 9.2) and an unrestricted file upload bug in Adobe Commerce and Magento (CVE-2026-48356, 'PolyShell', CVSS 9.3). Sansec observed a PolyShell-linked campaign infecting at least 953 online stores, ongoing since at least July 2025.
CVE-2026-111497 (Node2Shell, also called HTTP2Shell) is a memory-safety flaw in the Brotli decoder (c/dec/decode.c). Per Sysdig, the decoder confuses incomplete input with invalid input and keeps processing a malformed stream: a crafted stream declares one data block type and then requests a block-type switch, the unpatched decoder ignores the resulting error and writes past the end of its buffer (CWE-787). CISA describes the impact as allowing a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial of service, or potentially execute arbitrary code. Exposure requires the application to decompress attacker-influenced Brotli data: Express 5 / body-parser 2.x inflate 'Content-Encoding: br' request bodies, fetch() auto-decompresses Brotli responses from compromised servers or webhooks, and code can call node:zlib Brotli functions directly. Affected: Node.js below 26.12.1, 24.22.1 and 22.23.4 (EOL lines such as 25.x, 23.x and 20.x have no fix), Bun 1.4.3 and earlier (fixed 1.4.4), bundled Brotli 1.0.3-1.0.9, 1.1.0 and 1.2.0 (fixed 1.0.10, 1.1.1, 1.2.1), PHP and Microsoft .NET (fix covers .NET 8, 9, 10; .NET 6 remains exposed). The npm 'brotli' package is not affected. The fix was committed to Brotli in February 2026 and Node.js shipped patches on 2026-10-21; a public GitHub PoC appeared about five hours later. On 2026-10-22 Imperva reproduced code execution on Node.js 24.22.0 (Linux arm64) via fetch() and Express 5 body-parser, but only with repeated attempts; reliable blind RCE against ASLR has not been shown publicly, so DoS and memory disclosure are the most dependable impacts. Per the CISA alert (2026-10-26) exploitation is observed: Previdian recorded an exploitation attempt by 2026-10-27 and ELLIO detected public exploit traffic. Wiz reports 91% of cloud environments contain Brotli-vulnerable resources and 82% have publicly exposed Node.js instances.
CVE-2026-48356 (PolyShell) is an unrestricted file upload flaw in the Magento Open Source / Adobe Commerce REST API. Unauthenticated requests to POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId can carry a file-type custom option with an embedded file_info object (base64 data, MIME type, filename); the file is written under pub/media/custom_options/quote/. Sansec found no check that the option ID belongs to the product, no extension blocking (.php, .phtml, .phar accepted), and an image-header check (getimagesizefromstring) that is bypassed with polyglot GIF89a/PNG files carrying PHP. Depending on web server configuration the result is RCE or stored-XSS account takeover. Sansec reports all versions up to 2.4.8 vulnerable (The Hacker News: up to 2.4.9-alpha2); the fix first appeared in 2.4.9 pre-releases, Adobe released 2.4.9 on 2026-05-12 and a backport via APSB26-73 on 2026-07-14. Exploitation began 2026-03-16, mass scanning from at least 50 IPs started 2026-03-19, and a mass wave on 2026-03-30 compromised 471 stores in one hour. Observed payloads include password-protected eval(base64_decode()) webshells (index.php, json-shell.php, bypass.phtml, c.php, rce.php, static.php, mikhail.html and Unicode-escaped filenames) and the 'accesson.php' backdoor scattered across writable directories, which answers with beacon value 8194460 (409723*20). Two-stage obfuscated JavaScript loaders are injected into Magento CMS blocks/pages, fetch remote payloads from lanhd6549tdhse.top, jslibrary.net and canevaslab.com, persist via a localStorage key, and collect visitor fingerprinting data. Sansec's October 2026 report tied a campaign against at least 953 stores (five domains) to this CMS-block loader technique, active since at least July 2025. Some PolyShell attacks deliver a WebRTC-based payment-card skimmer (per press reports of Sansec research). The hunt skeleton and Security Affairs map CVE-2026-48356 to PolyShell; other sources reviewed do not state the CVE ID explicitly. CISA BOD 22-01 remediation deadline for both is 2026-10-29. No threat actor attribution is stated in any source.
MITRE ATT&CK techniques used in TL-2026-4637
Defense Evasion
T1027 Obfuscated Files or Information; T1036.008 Masquerading: Masquerade File Type; T1140 Deobfuscate/Decode Files or Information
Execution
T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Server Software Component: Web Shell
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
- Node.js — Node.js
Vulnerable versions: 26.x < 26.12.1; 24.x < 24.22.1; 22.x < 22.23.4; 25.x, 23.x, 20.x and earlier (EOL, no fix)
Fixed in: 26.12.1; 24.22.1; 22.23.4 - Oven — Bun
Vulnerable versions: <= 1.4.3
Fixed in: 1.4.4 - Google — Brotli
Vulnerable versions: 1.0.3-1.0.9; 1.1.0; 1.2.0
Fixed in: 1.0.10; 1.1.1; 1.2.1 - Microsoft — .NET
Vulnerable versions: 6 (no fix)
Fixed in: 8; 9; 10 (patched releases) - PHP — PHP (Brotli-linked builds)
Vulnerable versions: unpatched releases
Fixed in: vendor-patched releases - Adobe — Adobe Commerce / Magento Open Source
Vulnerable versions: up to 2.4.8 (Sansec); up to 2.4.9-alpha2 (The Hacker News)
Fixed in: 2.4.9; APSB26-73 backport for 2.4.7/2.4.8
Remediation for CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
Patches
- Node.js 26.12.1, 24.22.1, 22.23.4 (released 2026-10-21)
- Bun 1.4.4
- Brotli 1.0.10, 1.1.1, 1.2.1
- Magento Open Source / Adobe Commerce 2.4.9 (2026-05-12) and APSB26-73 backport (2026-07-14)
Immediate actions
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 (or later); upgrade Bun to 1.4.4+ and Brotli to 1.0.10 / 1.1.1 / 1.2.1
- Apply Microsoft .NET and PHP updates that include the Brotli fix; .NET 6 remains exposed
- Reject inbound 'Content-Encoding: br' request bodies at the reverse proxy or load balancer until patched
- Upgrade Adobe Commerce / Magento to 2.4.9 or apply the APSB26-73 backport
- Block web access to pub/media/custom_options/ (nginx: deny all; return 403, placed before any \.php$ location) and confirm Apache .htaccess disables PHP there
- Meet the CISA BOD 22-01 deadline of 2026-10-29
Workarounds
- Disable or avoid automatic Brotli decompression of untrusted request and response bodies
- Edge firewall rules blocking inbound Brotli attacks (e.g. Vercel rules from 2026-10-21)
- Hunt with: find pub/media/custom_options/ -type f ! -name '.htaccess' and find /var/www -name 'accesson.php' -type f
Longer-term hardening
- Migrate off end-of-life Node.js lines (25.x, 23.x, 20.x and earlier) that will never receive a fix
- Deploy a WAF that blocks unauthenticated guest-cart item uploads with file_info payloads
- Monitor Magento CMS blocks and pages for injected script loaders and changes to pub/media write paths
- Run runtime detection for Node.js crash-then-exec and shell spawns from Node.js processes
CVEs associated with CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
Weaknesses (CWE) in CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
Timeline of CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
- Sansec reports the Magento CMS-block loader campaign has been active since at least July 2025 (month-level date).
- Fix for the Brotli decoder flaw committed to the Brotli source in February 2026 (month-level date).
- Sansec observes first PolyShell exploitation and adds Shield protection.
- Automated mass scanning and exploitation of PolyShell begins, with at least 50 scanning IPs.
- Mass attack wave compromises 471 stores in one hour, deploying accesson.php and a CMS JavaScript loader.
- Adobe releases Magento / Adobe Commerce 2.4.9 containing the PolyShell fix.
- Adobe releases a backport for supported lines via APSB26-73.
- Node.js pre-announces a high-severity security release.
- Node.js 26.12.1, 24.22.1, 22.23.4, Bun 1.4.4 and Brotli 1.0.10/1.1.1/1.2.1 released; first public GitHub PoC appears about five hours later.
- Imperva demonstrates code execution on Node.js 24.22.0 (Linux arm64) via fetch() and Express 5 body-parser; CVSS 9.2 published.
- CISA alert adds CVE-2026-111497 and CVE-2026-48356 to the KEV catalog.
- Previdian records an exploitation attempt against CVE-2026-111497; ELLIO detects public exploit traffic.
- CISA BOD 22-01 remediation deadline for both vulnerabilities.
Sources cited for CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell)
- U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog
- Sansec: PolyShell - unrestricted file upload in Magento and Adobe Commerce
- Sansec: Mass PolyShell attack wave hits 471 stores in one hour
- Sysdig: Node2Shell (CVE-2026-111497) - detecting the Node.js Brotli RCE
- Aikido: Node2Shell Node.js Brotli RCE CVE-2026-111497
- HeroDevs: CVE-2026-111497 Node2Shell Node.js Brotli RCE
- The Hacker News: Magento PolyShell flaw enables unauthenticated file upload
- BleepingComputer: PolyShell attacks target 56% of all vulnerable Magento stores
- Security Affairs: PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks
- HKCERT: Node.js Multiple Vulnerabilities
Detection coverage for TL-2026-4637
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4637 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.