In our Node2Shell article we said the bug lives in Brotli itself, so other software that uses Brotli would need updates too. That turned out to be the whole story. The same bug, CVE-2026-111497, now has a bigger name: HTTP2Shell. Same bug, many more victims.
Watch the video
How a Node.js bug became an internet-wide problem, with a live check in an Ubuntu VM using Docker:
Quick background
CVE-2026-111497 is rated 9.2 (critical). It’s in Google’s Brotli compression library, versions 1.0.3 to 1.2.0. Inside the decoder there’s an 8-byte buffer. Feed it broken data and, instead of stopping, the decoder asks for more and keeps writing past the end. In the worst case, an attacker runs their own code.
How it evolved
- 21 Oct: Node.js ships its fix and the name Node2Shell appears.
- 22 Oct: the CVE is published and Python’s Brotli package gets a fix.
- 23 Oct: researchers find the same decoder inside Python HTTP libraries, Envoy and more. Bun confirms its own fix in 1.4.4. The name HTTP2Shell appears.
- 27 Oct: CISA adds CVE-2026-111497 to its Known Exploited Vulnerabilities catalog.
The twist: the code change itself landed in Brotli back in February, before anyone saw it as a security bug. The security fixes only came in October.
Why “HTTP”? Two doors in
Brotli is one of the ways the web compresses traffic. When data arrives with the header Content-Encoding: br, a lot of software unpacks it automatically. That gives an attacker two doors:
- Inbound: they send a Brotli request body to your server, like in our Express demo.
- Outbound: your server fetches a URL (a webhook, a link preview, a crawler) and the attacker’s server answers with Brotli.
Removing br from Accept-Encoding doesn’t help, because a malicious server can send Brotli anyway. And despite the name, this has nothing to do with the HTTP/2 protocol.
Who is affected?
- Node.js 22, 24 and 26 (Node 20 gets no fix) and Bun before 1.4.4.
- Python: requests, urllib3, aiohttp and httpx decode Brotli automatically when the Brotli package is installed, and that package gets about 82 million downloads a month.
- Envoy and Istio, if the Brotli decompressor is turned on.
- curl, when it’s built with Brotli.
- Phoenix Security also lists .NET, Ruby and PHP extensions, and data tools like DuckDB and ClickHouse.
Not affected: the Go port can only crash, the Rust one returns an error, and Apache and Nginx don’t decode Brotli by default. You’re only exposed if your software actually decompresses Brotli data from someone you don’t control.
Check your stack in one minute
In our demo the app is a small Flask service in Docker. We never installed Brotli ourselves, but pipdeptree shows Flask-Compress pulled it in, and it’s the vulnerable 1.2.0:
pip show Brotli brotlicffi
docker run --rm <image> pip show Brotli brotlicffi
pipdeptree -r -p Brotli
curl -V | grep -io 'brotli/[0-9.]*'
node --version && bun --version
Run the check in every environment and every container image, not just on your laptop.
Fixed versions
| Software | Fixed in |
|---|---|
| Brotli (Google) | 1.0.10 / 1.1.1 / 1.2.1 |
| Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 |
| Node.js | 22.23.4 / 24.22.1 / 26.12.1 |
| Bun | 1.4.4 |
| Envoy | 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8 |
| Istio | 1.29.9 / 1.30.6 / 1.31.2 |
| .NET (only if Brotli decompression is on) | 8.0.33 / 9.0.22 / 10.0.14 |
After updating, restart your processes and rebuild your container images. Can’t patch today? Turn off Brotli decompression where you control it (Envoy filters, framework middleware), and don’t fetch URLs from untrusted sources. Patching is the real fix.
Everything shown here was done on a throwaway test virtual machine (QEMU) built for the video, not on a production server. Read and understand each command, try it on a test system first, and back up before changing a real server.
Sources: Node.js security release · CVE record · CISA KEV alert, 27 Oct · Google Brotli releases · Aikido · Phoenix Security · Bun advisory
More on YouTube
Prefer watching? The full HTTP2Shell walkthrough is on our YouTube channel: watch the video. For more hands-on breakdowns of security bugs, Linux servers and dev tools, subscribe at youtube.com/@fineshotai.