A significant security vulnerability, designated as CVE-2026-111497 and informally referred to as ‘HTTP2Shell’, has been discovered in the Brotli C decoder library, which is integrated within Node.js. This issue allows potential attackers to compromise memory integrity and gain access to sensitive information.

The vulnerability primarily affects various versions of Brotli, specifically versions 1.0.3 through 1.0.9, along with 1.1.0 and 1.2.0. Its notoriety has led to multiple designations, including “Broccoli2Shell” and “Node2Shell,” due to its initial identification in Node.js.

Wide-Ranging Effects

Despite the name ‘HTTP2Shell’, the impact of this vulnerability goes beyond HTTP/2, potentially affecting any application using the flawed Brotli decoder to decompress data. Software at risk includes Python HTTP clients—such as urllib3[brotli], requests, httpx, and aiohttp[speedups]—whenever they are configured with affected Brotli versions.

Emergency Security Updates

In light of this vulnerability, Microsoft released a critical security update for .NET on Sunday, emphasizing that successful exploitation of the flaw might allow for privilege escalation on affected .NET systems.

The ‘Node2Shell’ vulnerability is characterized as a buffer overflow risk, where a crafted Brotli-compressed stream may trick the decoder into misinterpreting an invalid block switch as a valid input. This could lead to an overflow in an eight-byte internal buffer, causing memory corruption.

According to Node.js advisories, this scenario could result in application crashes, memory exposure, and potentially enable remote code execution (RCE). A report from cybersecurity firm Imperva corroborates that the exploitation of this vulnerability could indeed lead to RCE.

Patch Availability

The necessary fixes for the Brotli vulnerabilities were incorporated into the project’s source code as early as February. However, both Node.js and Google released stable patches for end-users on October 21, subsequently making a public disclosure the following day. The updated packages were made available for Python on October 23.

• Google Brotli: 1.0.10, 1.1.1, 1.2.1
• Node.js: 22.23.4, 24.22.1, 26.12.1
• Python Brotli: 1.2.1
• Python brotlicffi: 1.2.1.0

While proof-of-concept exploits have surfaced for this vulnerability, there currently are no known instances of malicious exploitation in real-world scenarios. Nonetheless, users are strongly advised to implement the security updates promptly.

Recommended Actions

After applying the updates, it is crucial for administrators to restart any affected processes, and those using container images must rebuild and redeploy them accordingly. Additionally, it is important to note that merely updating the system’s Brotli library will not mitigate risks for Node.js deployments or other applications utilizing their own versions of the library.

Simply blocking incoming Brotli requests is inadequate as this does not address your exposure to malicious HTTP-response routes. If immediate updates cannot be performed, it is recommended to disable Brotli support in Python applications and implement measures to block incoming Brotli-compressed requests at the proxy or firewall level.