HTTP2Shell (CVE-2026-111497): the critical Brotli decoder flaw and how to protect yourself

In short: HTTP2Shell (CVE-2026-111497) is a critical flaw in the Brotli decoder used by Node.js, Python, Bun, Envoy, .NET and many other programs. Specially crafted compressed data can corrupt memory and, under certain conditions, allow remote code execution. The fix is available: Node.js 22.23.4, 24.22.1 or 26.12.1 and Brotli 1.0.10, 1.1.1 or 1.2.1. Update, then restart your applications.

What is HTTP2Shell?

On 21 October 2026, the Node.js project released security updates for versions 22, 24 and 26. One of the fixed issues, CVE-2026-111497, is not in Node.js itself but in Brotli, the compression algorithm created by Google and widely used on the web as the br encoding.

The flaw has several names: HTTP2Shell, Node2Shell and Broccoli2Shell. They all refer to the same bug. The name “HTTP2Shell” is misleading: it has nothing to do with the HTTP/2 protocol. Any program that decompresses Brotli data from untrusted sources can be affected.

The flaw was discovered by Khai Tran and Sylvie Mayer (OpenAI Codex Security). The Imperva team showed that it can be used to execute code on a vulnerable Node.js version.

How the flaw works

Brotli data is split into blocks, and the decoder switches from one block to the next based on instructions in the compressed stream. When such an instruction is invalid, the vulnerable decoder does not treat it as an error. It reads it as a request for more input and keeps writing bytes into a buffer of only 8 bytes, past its end.

This type of bug is called an out-of-bounds write. Possible consequences, by severity:

• Process crash: the application goes down and the website or service becomes unavailable.
• Memory leaks: an attacker can read data from the process memory.
• Remote code execution: an attacker runs their own commands with the application’s privileges.

The attacker needs no account or password. Getting the application to decompress their data is enough.

How serious is it?

Ratings differ by source. The authority that issued the CVE rates it 9.2 out of 10 (critical) in CVSS 4.0. Node.js rates it high and Red Hat rates it important. What we know for sure as of 26 October 2026:

• public proof-of-concept code exists;
• code execution has been demonstrated on unpatched Node.js, but results vary from system to system;
• no real-world attacks have been reported yet, and the flaw is not in the CISA catalogue of actively exploited vulnerabilities.

With public code available, real attacks usually follow quickly. Treat the update as urgent.

Who is affected?

The Brotli library

Versions 1.0.3 to 1.2.0 are vulnerable. The fix is in 1.0.10, 1.1.1 and 1.2.1. Linux distributions often backport fixes without changing the version number, so check your distribution’s security notice, not just the number.

Affected programs and languages

PHP also rebuilt the official Windows packages for versions 8.2 to 8.5, because they include the Brotli library.

Programs with their own copy of Brotli

Many programs ship their own copy of the decoder. It is not fixed when you update the system library, only when a new version of the program is released. Those reported include ClickHouse, DuckDB, Apache Arrow (pyarrow), 7-Zip-zstd, p7zip, FFmpeg via libjxl (JPEG XL images) and WOFF2 font tools. For some of them, no official release with the fix was available on 25 October.

How an attack can reach you

• Requests to your server: an attacker sends a request with Content-Encoding: br, and the application decompresses the body automatically, for example through middleware in Express or ASP.NET Core.
• Responses your application fetches: your application requests a page or API from another server, which answers with poisoned Brotli data. fetch() in Node.js and the Python clients requests, HTTPX, aiohttp and urllib3 decompress Brotli responses automatically when support is installed.
• Uploaded files: JPEG XL images, Parquet files, archives or WOFF2 fonts that contain Brotli data.

The second path is the easiest to miss: even if your server never receives Brotli data, an application that fetches external resources is exposed.

Check whether you are affected

Node.js version (on the server, in every container and in every application under “Setup Node.js App” if you use cPanel):

node -v

Python packages (in every virtual environment):

pip show brotli brotlicffi

System library:

# Debian / Ubuntu
dpkg -l | grep -i brotli
# AlmaLinux / Rocky / CloudLinux / RHEL
rpm -qa | grep -i brotli

Processes that have the system library loaded and must be restarted after the update:

sudo grep -l brotlidec /proc/*/maps 2>/dev/null

Bun:

bun --version

Docker images carry their own Node.js version. Check every image, for example like this (replace IMAGE with your image name):

docker run --rm IMAGE node -v

How to protect yourself

1. Update

• Node.js: move to 22.23.4, 24.22.1 or 26.12.1 or later. If you use Node.js 18 or 20, move the application to 22 or 24, because those versions no longer receive fixes.
• Python: run pip install -U brotli brotlicffi in every environment that has these packages.
• Operating system: install security updates (apt upgrade or dnf upgrade) as soon as your distribution publishes the fixed package.
• Bun, Envoy, Istio, .NET: the versions in the table above.

pip install -U brotli brotlicffi

2. Restart and rebuild

A process started before the update keeps running the old code. Restart Node.js applications (for example with pm2 reload all or from cPanel), Python services and any process found by the command above. Rebuild Docker images on a fixed base image and check after start-up that the new version is running.

3. Temporary measures

If you cannot update right away, block incoming requests compressed with Brotli. Browsers do not send Brotli-compressed requests, so normal visitors are not affected. Do check whether integrations (APIs, apps) send such requests.

In nginx, in the server block:

if ($http_content_encoding ~* "br") {
    return 415;
}

In Apache (.htaccess):

RewriteEngine On
RewriteCond %{HTTP:Content-Encoding} br [NC]
RewriteRule ^ - [R=415,L]

Cloudflare published an emergency WAF rule for this flaw on 25 October, and Azure, Imperva and Vercel have similar rules. In Python you can temporarily uninstall the brotli and brotlicffi packages; without them, HTTP clients no longer decompress Brotli data.

Tip: These measures only protect data arriving at the server. They do not protect applications that fetch resources from other websites. Only the update protects you fully.

4. Watch for signs of an attack

• unexpected crashes of Node.js or Python applications (errors such as segmentation fault);
• requests with Content-Encoding: br in your web server logs;
• new processes or unusual connections started by the application user.

Recommendations by type of use

• WordPress or company website on web hosting: nothing to do. The hosting provider updates the system libraries. Keep WordPress, the theme and plugins up to date as usual.
• Node.js applications in cPanel: under “Setup Node.js App”, choose Node.js 22 or later and restart the application.
• VPS or your own server: you manage the system yourself. Run the checks above, update, restart and rebuild containers.
• Developers: update Node.js locally and in CI, rebuild images and check dependencies that ship their own copy of Brotli.
• Everyone else: update your browser and apps. Chrome and Firefox already include the fix.

What we have done at HostOn

On our web hosting servers, Node.js already runs the fixed version 22.23.4, including under “Setup Node.js App” in cPanel (from the Pilatus plan). Versions 18 and 20 no longer receive fixes, so move your applications to 22. We update system packages as soon as the distributions publish the fix. With a VPS you manage the system yourself and should apply the steps above. Need help? Open a ticket in the client area or write to us via the Contact page.

Timeline

• 21 October 2026: Brotli 1.0.10, 1.1.1 and 1.2.1 and Node.js 22.23.4, 24.22.1 and 26.12.1 are released.
• 22–23 October: the Python Brotli and brotlicffi packages are fixed; public proof-of-concept code appears.
• 24 October: fixes for the Ruby gem and the PHP brotli extension.
• 25 October: Microsoft updates for .NET and Cloudflare’s emergency WAF rule.
• 26 October: PHP has rebuilt its Windows packages; no real-world attacks have been reported.

Sources: BleepingComputer, Wiz, JFrog Security Research, Phoenix Security, Ubuntu Security, The Hacker News.