A critical memory corruption flaw in Google’s Brotli compression library, tracked as CVE-2026-111497 and circulating under the names HTTP2Shell, Node2Shell, Brotli2Shell and Broccoli2Shell, has pushed Node.js, Microsoft, PHP, Python package maintainers and Linux distributions into emergency patch cycles. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on October 27, 2026, giving federal civilian agencies until November 10 to remediate.
The bug sits in the Brotli decoder, the code that decompresses data, rather than in any single product. Any application that decompresses Brotli data an attacker can control may be exposed, whether that data arrives as a compressed HTTP request body, as a compressed response from a malicious server, or inside a file.
What HTTP2Shell is
Brotli is an open source compression format developed by Google and widely used to shrink web content sent over HTTP, where it appears as the br content encoding. The decoder ships inside a long list of software, either linked from the operating system’s libbrotli package or bundled as a private copy.
According to the GitHub security advisory and the NVD entry, the flaw is a buffer overflow in c/dec/decode.c affecting Google Brotli versions 1.0.3 through 1.2.0 on all platforms. A remote, unauthenticated attacker can use a crafted Brotli stream to corrupt adjacent decoder state memory, disclose sensitive memory contents, crash the process or potentially execute arbitrary code. Google, acting as the CVE Numbering Authority, scored it 9.2 (Critical) under CVSS 4.0. CISA classifies it under CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write).
Severity ratings differ by vendor. The Node.js project rates its instance High, Microsoft scores it 8.1 under CVSS 3.1 for .NET, and Red Hat rates it Important, citing high attack complexity and default hardening such as ASLR and SELinux.
Technical root cause
A Brotli stream can signal a switch between block types while it is being decoded. The Node.js security advisory explains that when a stream signaled a block switch that its own structure made invalid, the vulnerable decoder reported the condition as a temporary need for more input instead of a permanent format error. The streaming decoder then kept appending input bytes to an 8-byte internal buffer and wrote past its end.
The fix changes how the decoder handles that path. Block-switch handling now returns a proper error code, and Brotli introduces a new BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH error so invalid input stops decoding instead of leaving the decoder in a broken state. Node.js cherry-picked the upstream commit and exposed the new error constant in its own releases.
The Node.js advisory credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting the issue. Researchers who compared releases say the upstream fix was committed to the Brotli source repository in February 2026, months before the coordinated disclosure on October 21.
Affected software and fixed versions
Google shipped fixed Brotli releases 1.0.10, 1.1.1 and 1.2.1 on October 21. Downstream projects that bundle their own copy of the decoder need their own updates:
- Node.js: fixed in
22.23.4,24.22.1and26.12.1. End-of-life lines 20.x, 23.x and 25.x will not receive a fix. Exposure includeszlib.brotliDecompress(),zlib.createBrotliDecompress(), the built-infetch()API, which automatically decompresses Brotli responses, and Express 5 body parsing of compressed request bodies. - Python: the
Brotlipackage is fixed in1.2.1andbrotlicffiin1.2.1.0. Popular HTTP clients such as urllib3, requests, httpx and aiohttp load these packages automatically when they are installed. - Microsoft .NET: Microsoft’s advisory lists fixes in .NET
8.0.33,9.0.22,10.0.14and .NET 11 Release Candidate 3. Applications are only exposed when they enable ASP.NET Core request decompression, HttpClient automatic decompression or call Brotli APIs such asBrotliStream. .NET Framework is not affected. - Bun: fixed in
1.4.4. Executables built withbun build --compilemust be rebuilt. - Envoy Proxy and Istio: fixed releases shipped earlier in October, including Envoy
1.40.0,1.39.3,1.38.6and1.37.8and Istio1.29.9,1.30.6and1.31.2. Both are only exposed when Brotli decompression is configured. - PHP for Windows: the PHP project published rebuilt Windows packages
8.2.35-1,8.3.36-1,8.4.27-1and8.5.12-1on October 26, bundling Brotli 1.2.1. PHP source releases are unchanged. - Linux distributions: Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 as affected, along with bundled copies in Firefox, Thunderbird and Node.js packages. Debian has shipped a fixed package for its stable release.
The exposure reaches beyond web servers. JFrog Security Research reported that the flaw reaches FFmpeg through the libjxl library via Brotli-compressed metadata in JPEG XL files, where it obtained instruction pointer control but did not demonstrate code execution. The same research produced an infinite loop in Apache Arrow through compressed Parquet data and crashed a tested ClickHouse server with a single malformed HTTP request. At last check, ClickHouse had merged a fix without shipping a release, and the Apache Arrow issue remained open.
Exploitation status
Public proof-of-concept code is available. Imperva’s Red Team demonstrated code execution against the official Node.js 24.22.0 Linux arm64 build and has not released its exploit. ELLIO said it reproduced a shell on official Node.js 24.22.0 x86-64 builds under default configuration, against a plain node:http server, the official node:24.22.0-slim container image, Express 5.3.0 and Koa 3.
ELLIO also reported the first in-the-wild exploit attempt on October 26 at 15:08 UTC: a single HTTP request carrying a Brotli body of about 23 MB aimed at Node.js 24.22.0 on x86-64. ELLIO said the delivery code was copied from public proofs of concept, while the code-execution stage was original. In its own lab, the attacker’s chain crashed the target in 50 of 50 attempts without reaching a shell, and ELLIO called it a likely first-generation attempt. A day earlier, a scanner identifying itself as node2shell-check probed hosts to map which ones decompress Brotli at all.
CISA added CVE-2026-111497 to the KEV catalog the following day. CISA did not publish details of the activity behind the listing, and no confirmed compromise of a production system has been publicly attributed to this flaw at time of publication.
Scale is a concern. Akamai said its telemetry shows that 61% of networks are running affected Node.js versions.
How it relates to PHP2Shell
HTTP2Shell landed in the same week as PHP2Shell, a pair of critical unauthenticated remote code execution flaws in PHP core tracked as CVE-2026-109618 and CVE-2026-109619. They are separate bugs in separate code. PHP2Shell affects PHP installations serving web requests, and CISA’s alert urges updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. BreachNews covered the disclosure in PHP2Shell: Two Critical PHP Vulnerabilities Threaten Millions of Websites as Attacks Emerge.
PHP2Shell has since moved from probing to confirmed exploitation. A honeypot operator reported working shells against Apache mod_php running PHP 8.4.26 on October 24, and CISA added both CVEs to the KEV catalog on October 26 with a remediation deadline of October 29. The two flaws overlap in places: PHP’s Windows builds needed a Brotli rebuild, and ELLIO said the source of the first HTTP2Shell attempt had previously been tagged for PHP2Shell exploitation. Organizations running PHP on Windows should apply both the PHP2Shell releases and the -1 Brotli rebuilds.
The naming follows the pattern set by React2Shell and WP2Shell, both of which drew rapid mass scanning after disclosure.
Mitigation
Patching is the only complete fix, and it only takes effect once running code picks it up:
- Upgrade every copy of the decoder, not just the system library. Node.js, Bun, .NET self-contained and NativeAOT builds, PHP extensions and many applications carry their own vendored copy.
- Restart services after updating system packages, and rebuild and redeploy container images. A Dockerfile that pins a vulnerable Node.js version keeps shipping it.
- Cover staging, CI runners, build images, serverless runtimes and developer machines, not only production.
Where patching is delayed, vendors and researchers suggest temporary steps:
- Strip or reject inbound requests with
Content-Encoding: brat the reverse proxy or load balancer. This does not protect clients that fetch Brotli responses from attacker-controlled servers. - Disable Brotli decoding in HTTP clients. Removing
brfrom theAccept-Encodingheader is not enough on its own, because a hostile server can still send Brotli-encoded data. - In Express and body-parser, set the
inflateoption tofalseif the application does not need compressed request bodies. - Remove the
Brotliorbrotlicffipackage from Python environments until a fixed version is installed.
Detection
Version checks need care. ELLIO notes that Node.js cherry-picked the fix without bumping the bundled version string, so process.versions.brotli reports 1.2.0 on both patched and vulnerable builds. Check the Node.js release version instead.
Defenders can also hunt for the following signals described by researchers:
- Inbound requests with
Content-Encoding: brand multi-megabyte bodies, which are rare in normal traffic. - Bursts of Node.js segmentation faults or worker restarts shortly after large Brotli request bodies, since failed attempts usually crash the process.
- Requests with the user agent
Mozilla/5.0 (compatible; node2shell-check/1.0). - The exploit request ELLIO observed came from
94.154.43.7, with a body hash of7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b(SHA-256).
ELLIO also warned that core dumps written after forced crashes, for example under /var/lib/systemd/coredump, can hold other users’ session cookies and tokens. Restrict access to those files and expire them quickly.
What remains unknown
Several questions are still open. CISA has not said what evidence led to the KEV listing, and no victim organization has disclosed a compromise through this flaw. It is unclear how reliably public exploit chains work beyond the specific Node.js builds researchers tested, and whether attackers will turn the file-based paths in FFmpeg, Arrow and similar software into working attacks. The full list of products that embed a vulnerable Brotli copy is also still growing, and Red Hat says its investigation remains ongoing.
Google had not issued any public statement beyond its release notes at time of publication. BreachNews will update this article as more vendors ship fixes and as exploitation details emerge.
