Brotli's streaming decoder holds an eight-byte internal buffer for input it has not finished reading. A specially crafted Brotli stream can trigger an invalid block switch that the decoder treats as a temporary request for more input instead of a permanent format error. It keeps appending input bytes to that eight-byte buffer, the write runs past the buffer's bounds, and nearby memory gets corrupted. That is CVE-2026-111497, and depending on which stack it was found in, it goes by HTTP2Shell, Broccoli2Shell, or Node2Shell.
The three names come from one bug surfacing in different places. Researchers first identified it in Node.js, where Brotli ships as a built-in C decoder library, then realized the flaw lived in the Brotli decoder itself and so reached any software that decompresses attacker-controlled Brotli data. Brotli is Google's open-source lossless compression library, which makes the reach wide. Affected versions run from 1.0.3 through 1.0.9, plus 1.1.0 and 1.2.0.
Beyond Node.js, the Python HTTP clients are in scope: urllib3[brotli], requests, httpx, and aiohttp[speedups], when configured with a vulnerable Brotli decoder. Microsoft pushed an emergency update for .NET on Sunday, warning that exploitation allows privilege escalation on systems running a vulnerable version. Any application that links a vulnerable Brotli implementation is a candidate.
The name HTTP2Shell points at HTTP clients and servers, but the bug has nothing to do with HTTP/2 specifically. An attacker needs an application to decompress malicious Brotli data. One route is a server returning a compressed HTTP response to a client fetching a URL; another is a client sending a compressed request directly to a server. Node.js says the result can be a crashed process, exposed memory, or remote code execution. Imperva's analysis confirms the RCE path is real. Proof-of-concept exploits are public, and no in-the-wild exploitation has been reported.
The fix landed upstream well before most people heard about it. Google committed the Brotli repairs in February, but stable releases came on October 21 from Google and Node.js, with public disclosure the next day. PyPI packages followed on October 23. Patched versions:
- Google Brotli 1.0.10, 1.1.1, 1.2.1
- Node.js 22.23.4, 24.22.1, 26.12.1
- Python Brotli 1.2.1
- Python brotlicffi 1.2.1.0
Two patching traps are worth calling out. Updating your system Brotli library does nothing for a Node.js deployment, or any other application that bundles its own copy; you update the application, not the OS package. Restarting matters too: after updating, processes need a restart, and container images have to be rebuilt and redeployed rather than patched in place.
Blocking inbound Brotli-compressed requests at your proxy or firewall still leaves the HTTP-response route exposed, where your own client fetches a URL and decompresses what comes back. If you cannot patch right away, the recommendation is to remove Brotli support from Python applications and block incoming Brotli requests at the proxy or firewall, with the understanding that this does not close the HTTP-response path.
Top comments (0)