Brotli’s Critical ‘HTTP2Shell’ Vulnerability Triggers Emergency Patches

A critical flaw dubbed “HTTP2Shell” in Brotli, the C decoding library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

The security issue is being tracked as CVE-2026-111497 and is also known as “Broccoli2Shell” and “Node2Shell.” This affects Brotli versions 1.0.3 to 1.0.9, 1.1.0 and 1.2.0.

The vulnerability has been reported under several names because it was initially identified in Node.js before researchers discovered that the same flaw in the Brotli decoder could affect software in multiple ecosystems.

Brotli is an open source project developed and maintained by Google for lossless data compression. It shrinks files so that they can be transmitted faster without affecting the original data.

Broad impact

The name HTTP2Shell reflects its impact on HTTP clients and servers, although the vulnerability is not specific to HTTP/2 and may affect other applications that decompress Brotli data controlled by attackers.

Besides Node.js, potentially affected software includes Python HTTP clients such as urllib3(brotli), requests, httpxAnd aiohttp (speedups)when configured with a vulnerable Brotli decoder, as well as other applications and tools that use vulnerable Brotli implementations.

On Sunday, Microsoft released an emergency security update to address the issue in .NET, warning that successful exploitation allows for privilege escalation on systems with a vulnerable .NET version.

The Node2Shell vulnerability is a buffer overflow that allows a specially crafted Brotli compressed stream to trigger an invalid block switch that the decoder treats as valid and misinterprets as a request for additional input.

By continuing to add input bytes to an internal eight-byte buffer, the write extends beyond its limits, corrupting nearby memory.

“An invalid block switch was reported as a temporary need for additional inputs instead of a permanent format error, so the streaming decoder continued to add input bytes to an internal eight-byte buffer,” Node.js explains in an advisory.

An attacker can exploit this by forcing an application to decompress malicious data, for example by providing a compressed HTTP response to an application retrieving a URL, or by sending a compressed request directly to a server.

Node.js says this can crash the process, expose memory, and enable remote code execution (RCE).

A recent report from cybersecurity firm Imperva confirms that exploitation of the Node2Shell CVE-2026-111497 vulnerability can lead to an RCE.

Upstream Brotli fixes were first committed to the project’s source code in February, but Node.js and Google released stable fixes to users on October 21, followed by a public disclosure the next day. PyPI packages containing the fixes became available on October 23.

The corrected versions are:

• Google Brotli 1.0.10, 1.1.1, 1.2.1
• Node.js 22.23.4, 24.22.1, 26.12.1
• Python Brotli 1.2.1
• Python Brotlicffi 1.2.1.0

Proof-of-concept (PoC) exploits for Node2Shell have been released, but there are no reports of malicious exploitation in the wild. Still, users should prioritize applying available security updates.

After updating, administrators must restart affected processes and affected container images must be rebuilt and redeployed.

A dedicated online portal tracking the impact of the flaw also warns that updating the Brotli system library does not address the risk from Node.js deployments or other applications that use their own bundled copy of the library.

Additionally, blocking incoming Brotli requests still leaves the malicious HTTP response route exposed.

If updating immediately is not possible, it is recommended to remove Brotli support from Python applications and block incoming Brotli-compressed requests at their proxy or firewall.