Executive Summary
A critical flaw dubbed “HTTP2Shell” in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. Tracked as CVE-2026-111497s the vulnerability is also known as “Broccoli2Shell” and “Node2Shell.” Node.js says the flaw can crash the process, expose memory, and enable remote code execution (RCE), and an Imperva report confirms RCE is achievable.
Microsoft pushed an emergency security update on Sunday, 25 October 2025, to address the issue in .NET, warning that exploitation allows privilege escalation on systems with a vulnerable .NET version. Proof-of-concept exploits have been published, but there are no reports of malicious exploitation in the wild. Users should nonetheless prioritize applying the available security updates.
Key Technical Details
Vulnerability Overview
- Affected versions: Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. 1
- Multiple names: The flaw was initially identified in Node.js before researchers found that the same flaw in the Brotli decoder could affect software across multiple ecosystems.
- Scope: The name reflects its impact on HTTP clients and servers, but the vulnerability is not specific to HTTP/2 and can affect other applications that decompress attacker-controlled Brotli data.
- Potentially affected software: Besides Node.js, Python HTTP clients such as urllib3[brotli], requests, httpx, and aiohttp[speedups], when configured with a vulnerable Brotli decoder, as well as other applications and tools using vulnerable Brotli implementations.
Root Cause
- It is a buffer overflow in which a specially crafted Brotli-compressed stream triggers an invalid block switch that the decoder treats as valid and misinterprets as a request for more input.
- The decoder keeps appending input bytes to an internal eight-byte buffer, so the writing extends beyond its bounds and corrupts nearby memory.
Attack Vectors
An attacker can exploit it by getting an application to decompress malicious data, such as by serving a compressed HTTP response to an application fetching a URL, or by sending a compressed request directly to a server.
Timeline
- Upstream Brotli fixes were first committed in February; Node.js and Google released stable fixes on 21 October 2026, followed by public disclosure the next day.
- PyPI packages containing the fixes became available on 23 October 2026.
Mitigations
Patch
Patched versions are: Google Brotli 1.0.10, 1.1.1, 1.2.1; Node.js 22.23.4, 24.22.1, 26.12.1; Python Brotli 1.2.1; Python brotlicffi 1.2.1.0.
Post-update Actions
- Restart affected processes and rebuild and redeploy affected container images.
- Updating the system Brotli library does not address the risk in Node.js deployments or other apps that use their own bundled copy of the library.
Workarounds
- Remove Brotli support from Python applications and block incoming Brotli-compressed requests at the proxy or firewall level.
- Blocking inbound Brotli requests still leaves the malicious HTTP-response route exposed, so this is only a partial control.
