The short version
CVE-2026-111497 is a critical (CVSS 4.0: 9.2) out-of-bounds write in the Brotli decoder, versions 1.0.3 to 1.2.0, and fixes now exist for Node.js, .NET, Python, Bun and Envoy. A crafted compressed stream can crash a process, leak memory or, in some setups, run code. If your Node.js services, Python apps or ASP.NET Core APIs decompress data from users or third-party servers, update the runtime first, then hunt for copies of Brotli bundled inside other software.
What is the HTTP2Shell Brotli vulnerability?
Brotli is a compression format created by Google and used across the web for HTTP responses, file formats and data pipelines. The flaw sits in the decoder’s handling of block switches. According to the Node.js advisory, an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept writing incoming bytes into an eight-byte internal buffer and past its end. An attacker who can feed Brotli data to an application can corrupt process memory. The result may be a crash, a leak of process memory or remote code execution.
The bug was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security and fixed in Node.js by Matteo Collina and Antoine du Hamel. iTnews reported that the underlying code change landed in Brotli’s source in February 2026, but was not recognized as a security fix and did not ship in a Brotli release until October. The name changed as the scope grew: Node2Shell for Node.js, then HTTP2Shell once researchers confirmed that HTTP libraries and applications in other languages were exposed too.
Which runtimes and products are affected?
Any software that ships Brotli 1.0.3 through 1.2.0 and decompresses untrusted input is in scope. These fixes are confirmed by vendors or package maintainers:
- Node.js: 22.23.4, 24.22.1 and 26.12.1 (October 21). The bug is reachable through
node:zlib. - .NET: 8.0.33, 9.0.22 and 10.0.14, plus 11.0.0-rc.3, released out of band on October 25 for .NET and ASP.NET Core.
- Python: Brotli 1.2.1 and brotlicffi 1.2.1.0 on PyPI.
- Bun: 1.4.4. Envoy: 1.40.0, 1.39.3, 1.38.6 or 1.37.8 if Brotli decompression is enabled.
The harder part is software that embeds its own copy of the decoder. Security researchers and iTnews list examples such as databases, data libraries, desktop apps built on Electron, PDF and archive tools, and language runtimes like PHP and Ruby. Patch status differs by vendor, so check each product’s advisory instead of assuming it is affected or safe.
What it means for US & EU software teams
First, the attack works in both directions. A server that accepts Brotli-encoded request bodies or uploads can be attacked by a malicious client. A service that calls third-party APIs or scrapes the web can be attacked by a malicious server, because HTTP clients often decompress responses automatically. Teams usually think only about public endpoints. Outbound integrations, webhook consumers and data ingestion jobs belong on the patch list too.
Second, your lockfile is not your inventory. Python’s pip-audit and npm audit will flag the PyPI packages and the Node.js runtime, but a decoder compiled into a binary or a container base image never shows up as a dependency. This is where a software bill of materials (SBOM) and container image scanning pay off. Teams in finance and healthcare that report to regulators under DORA, NIS2 or HIPAA security rules should record when they found exposure and when they patched it, because auditors will ask.
Third, AI-driven bug hunting is speeding up disclosures. This flaw, like the PHP2Shell bugs earlier this month, was found by an AI security tool. Expect more critical findings in old, widely shared libraries, and plan your patch process around days, not quarterly maintenance windows.
What should teams patch first?
- Internet-facing runtimes. Upgrade Node.js, .NET and Bun on any service that accepts compressed request bodies or uploads.
- Python environments. Run
pip show Brotli brotlicffiin every environment and image, and pin 1.2.1 or newer. - Proxies and gateways. Update Envoy and check the vendor status of any load balancer or API gateway that decompresses traffic.
- Outbound clients. Patch services that fetch third-party content, scrape the web or consume webhooks.
- Rebuild containers. Pull fixed base images and rebuild, because patching the host does not fix the image.
- Hunt bundled copies. Search SBOMs and binaries for Brotli versions 1.0.3 to 1.2.0 and track vendor advisories for embedded copies.
- Watch for crashes. Alert on unexpected restarts of services that decompress data. Repeated crashes can be the first sign of exploit attempts.
Frequently asked questions
What is HTTP2Shell (CVE-2026-111497)?
HTTP2Shell is the nickname for CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder, versions 1.0.3 through 1.2.0. A crafted Brotli-compressed stream can corrupt memory in the process that decompresses it, which can cause a crash, leak memory or, in some setups, allow remote code execution. It was first called Node2Shell because Node.js was the first major runtime to ship a fix, on October 21, 2026. It carries a CVSS 4.0 score of 9.2.
Which versions fix the Brotli flaw?
Node.js 22.23.4, 24.22.1 and 26.12.1; .NET 8.0.33, 9.0.22 and 10.0.14 (released October 25, 2026); the Python Brotli package 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; and Envoy 1.40.0, 1.39.3, 1.38.6 or 1.37.8. Software that builds Brotli from source needs a Brotli release that contains the fix, such as 1.2.1.
Is my application affected if I only use Brotli for compression?
The bug is in the decoder, so the risk comes from decompressing Brotli data you do not control. That includes servers that accept Brotli-encoded request bodies or uploads and clients that decompress responses from third-party servers. Compressing your own responses is not the attack path, but runtimes should still be updated because the decoder ships in the same package.
Why do dependency scanners miss some vulnerable copies?
Scanners read package lockfiles and advisory databases. Many products compile Brotli directly into their binaries or vendor its source code, so no package entry appears for it. Those copies are fixed only when the vendor ships a new build, so you need vendor advisories, container image scans and software bills of materials (SBOMs), not just a lockfile check.
Sources
Node.js — Wednesday, October 21, 2026 Security Releases (primary source)
Microsoft .NET — October 2026 out-of-band security updates (primary source, October 25, 2026)
The Hacker News — Brotli decoder flaw behind Node.js RCE also affects Bun, Python and other widely used software
iTnews — Node2Shell flaw embedded in apps and dev tools far beyond Node.js (October 25, 2026)
Aikido Security — Python packages vulnerable to the Brotli flaw (fixed versions for Python, Bun, Envoy)