HTTP2Shell: The Brotli Bug That Reached Almost Every HTTP Stack

Aikido Security named it “HTTP2Shell” on 23 October, when a Brotli bug disclosed in Node.js two days earlier spread to a much wider set of HTTP software.

OpenAI found the bug in February, and it was fixed in Brotli's source code then. Nobody flagged it as a security problem, so no release shipped the fix until October. Now every project that bundles Brotli has to ship its own update: runtimes, libraries, proxies, appliances and container images.

Check your stack

Pick what you run, then the version. You get a verdict and the next thing to do. It runs in your browser and sends nothing anywhere.

What went wrong

Brotli is Google's compression format for web traffic. Its decoder ships inside Node.js, Python packages, Bun, .NET, Envoy, curl, CDNs and API gateways, usually as a dependency nobody chose.

In versions 1.0.3 to 1.2.0, a crafted stream makes the decoder write past the end of a small buffer. That can leak memory, crash the process or let an attacker run code. It works both ways. A malicious client can attack a server that decodes request bodies, and a malicious server can attack a client that decodes responses. No login is needed. NVD lists Google's CVSS v4.0 score of 9.2, critical. Node.js rates it high.

Fixed versions

From the advisories published between 21 and 26 October:

On Ubuntu 22.04 and later, Ubuntu's own Node.js package uses the system Brotli library, so updating the OS package is the fix there. Containers and compiled binaries need a rebuild as well. A patched host does not patch an image that bundles the old library.

Is it being used in attacks?

Not that anyone has reported. As of 26 October, Rapid7 knew of no attacks in the wild, and the flaw is not on CISA's list of known exploited vulnerabilities.

Imperva's red team did run its own code on the official Node.js 24.22.0 image, after several attempts, and has not released the exploit. Public proof-of-concept code mostly crashes the process or leaks a little memory on a standard build (Sysdig).

Security researcher s1r1us of Hacktron thinks the same thing is holding attackers back here as with PHP2Shell: the exploit is hard to adapt from one target to the next. In their PHP2Shell test, only the most capable commercial AI models managed it; the freely downloadable ones did not. s1r1us also warns the gap may not last, as open models are improving fast. Use the quiet to patch.

If you cannot patch today

Stop decoding Brotli until the components are fixed.

• Incoming requests: at the proxy, load balancer or middleware, reject any request whose Content-Encoding includes br. Match case-insensitively and handle lists of encodings.
• Outbound requests: remove br from Accept-Encoding and turn off automatic decoding. A malicious server can send Brotli anyway, and libraries such as urllib3 pick the decoder from the response header.
• Python: if Brotli is optional, uninstall Brotli and brotlicffi, remove extras such as httpx[brotli], regenerate the lockfile and restart.
• Managed hosting or CDN: ask the provider which Brotli version it runs and when it was patched.

Frequently asked questions

Are we safe because we use nginx or Apache?

Not automatically. Their standard Brotli modules only compress responses, so the web server itself is fine. A Node, Python or Go app behind it that decompresses request bodies is still exposed.

Does a clean scan mean we are patched?

No. For the first few days the CVE was not mapped to the PyPI packages, so pip-audit and Dependabot missed a vulnerable Brotli or brotlicffi. Aikido reported on 26 October that both flag them now, but a scanner with an out-of-date database can still miss it. Check lockfiles and installed versions directly.

Sources

• Aikido: Node2Shell evolves to HTTP2Shell (CVE-2026-111497). 23 October 2026, updated 26 October. Timeline, affected projects, fixed releases, scanner coverage and the Apache note.
• NVD: CVE-2026-111497. Published 22 October 2026.
• Node.js October 2026 security releases. The Node.js advisory.
• GitHub advisory GHSA-9v8h-qqgm-4m35
• Aikido on X (@AikidoSecurity). 23 October 2026. The “HTTP2Shell” announcement.
• Microsoft Security Update Guide: CVE-2026-111497. 25 October 2026. .NET, PowerShell and Visual Studio updates.
• Ubuntu and Debian security trackers. Fixed brotli packages.
• ngx_brotli. Google's nginx module, which compresses responses and serves pre-compressed files.
• Rapid7: CVE-2026-111497. 26 October 2026. No known attacks in the wild; not on CISA's KEV list.
• Sysdig: Detecting the Node.js Brotli RCE. 24 October 2026. Imperva's result and the state of public exploit code.
• s1r1us on X. 26 October 2026. Which AI models could port the PHP2Shell exploit, and why exploitation may be held back.

Worried about a gap?

If you would like a second pair of eyes on your stack, talk to us. We help Perth businesses inventory dependencies, patch runtimes and rebuild images without the guesswork.

Related reading: PHP2Shell: Two Critical PHP Flaws and The eMudhra Certificate Authority Compromise.

Photo credits. All photos are CC0 1.0 (public domain dedication), from Wikimedia Commons and the WordPress Photo Directory:

• Server racks at NERSC — Derrick Coetzee
• Raspberry Pi on a network switch — RAIL P
• Padlock and chain — Jennifer Bourn