HTTP2Shell (CVE-2026-111497): Patch Brotli Beyond Node.js

Last updated: 26 October 2026. Sources are listed at the end.

HTTP2Shell is the name now used for CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder. It first surfaced on 21 October 2026 as a Node.js fix, which Imperva nicknamed Node2Shell. However, the bug lives in the Brotli C library itself. So any software that decodes Brotli with that code needs its own update.

That list is long. It covers Bun, Python, Envoy, Istio, distro libbrotli packages and programs that bundle their own copy. We covered Node.js alone in our Node.js October 2026 release guide. This HTTP2Shell guide covers every other stack: what to patch, how to find hidden copies and what to do meanwhile.

The short answer

• Upgrade every Brotli decoder you run. Upstream fixed versions are 1.0.10, 1.1.1 and 1.2.1, released on 21 October.
• Patch runtimes and proxies too. The fixed versions per stack are in the table below.
• Then restart services and rebuild container images. A running process keeps the old decoder in memory.
• Next, search for bundled copies. Version strings can lie, so check the binaries themselves (commands below).
• If you cannot patch yet, refuse request bodies sent with Content-Encoding: br at your proxy. Note that this does not protect outbound fetches.

What HTTP2Shell actually is

Despite the name, this is not an HTTP/2 protocol bug. Brandefense makes that point clearly. Instead, the flaw sits in c/dec/decode.c, the part of Brotli that unpacks compressed data.

In plain terms, the decoder mixed up two situations. A broken “block switch” was reported as “need more input”, not “invalid data”. As a result, the streaming decoder kept adding bytes to a small internal buffer. The Node.js advisory says this buffer is eight bytes long, so extra bytes spill into nearby memory. That can cause a crash, leak memory contents or, in some cases, allow code execution.

The upstream fix is commit 0ed4268 in google/brotli, titled “Detect and report invalid stream earlier”. It adds a new error code, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17). That name matters later, because it gives us a way to spot patched binaries.

HTTP2Shell works in both directions. For example, a malicious client can attack a server that decompresses request bodies. Equally, a malicious server can attack a client that fetches from it, such as a webhook sender or crawler. Removing br from Accept-Encoding does not help, because several clients pick the decoder from the response header anyway.

HTTP2Shell timeline

• February 2026: OpenAI reported the bug, and the root cause was fixed in Brotli’s source. No release carried it until October, according to OpenAI as quoted by The Hacker News.
• 15 October: Istio ships 1.31.2, 1.30.6 and 1.29.9. Its bulletin ISTIO-SECURITY-2026-007 lists CVE-2026-111497 for the Envoy Brotli library.
• 21 October: Node.js ships 22.23.4, 24.22.1 and 26.12.1. Google tags Brotli 1.0.10, 1.1.1 and 1.2.1.
• 22 October: GHSA-9v8h-qqgm-4m35 and the NVD entry go live. PyPI receives brotli 1.2.1 and brotlicffi 1.2.1.0. Bun 1.4.4 lists Brotli among its security-fixed components.
• 23 October: Envoy publishes GHSA-3wvj-j6qm-62mr. Aikido starts calling the wider issue HTTP2Shell. Debian ships DSA-6582-1 for trixie.
• 24–25 October: Phoenix Security starts tracking bundled copies. Cloudflare reportedly ships an emergency WAF rule.

Credit for the discovery goes to Khai Tran and Sylvie Mayer of OpenAI Codex Security.

Exploitation status: confirmed vs reported

• Demonstrated RCE: Imperva ran code on the official Node.js 24.22.0 Linux arm64 build. It needed several attempts, and Imperva has not released the exploit.
• Public PoCs: Phoenix Security reports that the first public PoC (ikow/brotli2crash) only reached code execution on a deliberately weakened build. On standard builds it caused a crash and a limited memory read.
• Red Hat: It states there is no public, reliable RCE proof of concept.
• In the wild: No exploitation has been reported. CISA’s assessment on 23 October recorded exploitation as “none”.
• CISA KEV: Not listed as of 24 October, per Phoenix Security and Brandefense. We could not re-check the KEV feed ourselves today.

Severity ratings differ. Google and Envoy give CVSS 4.0 9.2 (critical). Node.js says “high”, while Red Hat says 8.1 (important).

Am I affected?

You are exposed to HTTP2Shell if any process decodes untrusted data with Brotli 1.0.3 to 1.2.0.

HTTP2Shell fixed versions by stack

For Next.js, the risk comes through Node.js. Vercel says hosted projects run patched runtimes, while self-hosted apps must upgrade Node.js themselves. Phoenix Security also reports fixes for the Ruby brotli gem (0.9.1), the PHP brotli extension (0.21.1) and MuPDF (1.28.0). We could not confirm the PHP release on the extension’s GitHub page today. Brandefense reports that ngx_brotli moved its Brotli submodule to 1.2.1 but has no release tag.

Linux distribution packages

Sources disagree on two rows. Brandefense lists Debian sid as fixed, but the Debian tracker still shows it vulnerable. Also, Phoenix Security mentions an Ubuntu 24.04 backport, yet Ubuntu’s own CVE page shows no fix. We trust the distro trackers here.

Bundled copies you might not know about

Phoenix Security tracks programs that ship their own Brotli. On 25 October, its unpatched list included the .NET runtime, DuckDB, ClickHouse, Apache Arrow, p7zip and EDK II.

We also found one in our sandbox. The current Pillow wheel (13.0.0) bundles libbrotlidec 1.2.0 without the fix marker. FreeType uses it for WOFF2 fonts. We found no Pillow advisory, and exposure would need untrusted fonts. Still, it shows how easily copies hide.

How to check for HTTP2Shell

First, check the Python packages in each environment or virtualenv:

python3 -m pip show brotli brotlicffi 2>/dev/null | grep -E '^(Name|Version|Location)'
python3 -c "import urllib3.util.request as r; print(r.ACCEPT_ENCODING)"

If the second line prints br, urllib3 (and requests) will decode Brotli automatically. In our test it showed gzip,deflate,br only after brotli was installed.

Next, check runtimes and distro packages:

node --version
bun --version
dpkg -l 'libbrotli*' 'brotli*' | grep '^ii'
rpm -q brotli libbrotli        # RHEL, Fedora, SUSE (not tested here)
apk info -v brotli-libs        # Alpine (not tested here)

Do not rely on node -p process.versions.brotli. In our tests, both unpatched Node.js 22.23.3 and patched 22.23.4 reported 1.1.0.

Then scan for every decoder copy on the host. Patched code contains the string _ERROR_FORMAT_BLOCK_SWITCH, so this read-only script flags copies without it:

#!/bin/sh
# Read-only: list Brotli decoder copies and whether they carry the fix marker
find / -xdev -type f \( -name 'libbrotlidec*.so*' -o -name '_brotli*.so' \
  -o -name '_brotlicffi*.so' -o -name '*brotli*.node' \) 2>/dev/null |
while IFS= read -r f; do
  if grep -q '_ERROR_FORMAT_BLOCK_SWITCH' "$f"; then
    echo "marker found  $f"
  else
    echo "NO marker     $f"
  fi
done

The same grep -c works on single binaries. It returned 3 for Node.js 22.23.4, 2 for Bun 1.4.4 and 0 for Node.js 22.23.3. Treat a hit as a strong sign of the fix. However, a miss is not proof of a bug, because distro backports may skip the new string.

Finally, list running processes that have a Brotli library loaded:

sudo bash -c 'grep -l -i brotli /proc/[0-9]*/maps 2>/dev/null | while IFS= read -r m; do
  p=${m#/proc/}; p=${p%/maps}; echo "$p $(cat /proc/"$p"/comm)"; done'

For container images, these commands follow the Syft, Grype and Trivy docs; we did not run them. Scanners read package metadata, so they can miss bundled copies.

syft myimage:tag | grep -i brotli
grype myimage:tag | grep -i -e brotli -e CVE-2026-111497
trivy image myimage:tag | grep CVE-2026-111497

How to fix HTTP2Shell, stack by stack

1. Python: run python3 -m pip install -U 'brotli>=1.2.1' 'brotlicffi>=1.2.1.0', then regenerate lockfiles and restart workers.
2. Node.js and Bun: move to the fixed releases above. Also rebuild Docker images and any compiled Bun executables.
3. Envoy and Istio: upgrade the proxy and every sidecar, then restart gateway and workload pods.
4. Debian and Ubuntu hosts: run sudo apt update && sudo apt upgrade, then restart services that link libbrotli1. Note that needrestart can list them.
5. Vendored code: cherry-pick commit 0ed4268 into your tree, or bump to a fixed tag, and rebuild.
6. Verify: re-run the marker scan and check the version each live workload reports.

Workarounds if you cannot patch today

Node.js and Bun have no real workaround, so upgrading is the only fix. Meanwhile, you can reduce inbound exposure at the edge. We tested both rules below in our sandbox: br and gzip, br got a 415, while gzip passed.

For nginx, inside the server block:

if ($http_content_encoding ~* "(^|,)\s*br\s*(,|$)") { return 415; }

For HAProxy 2.8, in the frontend:

http-request return status 415 if { req.hdr(content-encoding),lower -m reg (^|,)\s*br\s*(,|$) }

In Envoy or Istio, remove the Brotli decompressor filter (envoy.compression.brotli.decompressor) until you upgrade. Similarly, in Python you can uninstall brotli and brotlicffi, so that clients fall back to gzip.

Keep the limits in mind, though. WAF rules from Cloudflare, Azure, Imperva and Vercel only cover inbound requests. They do not protect responses your code fetches.

Was I already hit?

No vendor has published HTTP2Shell IOCs, so we will not invent any. Instead, look for the signals Upwind describes:

• Crashes or restarts of Node.js, Python or proxy processes shortly after requests carrying Content-Encoding: br.
• Unusually large or slow Brotli request bodies in proxy logs.
• Web runtimes spawning shells or opening unexpected outbound connections.

If your nginx log format records the request header, this lists Brotli bodies:

grep -i 'content-encoding.*br' /var/log/nginx/access.log | tail -50

A note for Indian teams

We found no CERT-In advisory for CVE-2026-111497 as of today. A crash is a nuisance, but leaked memory from a service holding customer data may be a breach. DPDP Rule 7 will require a detailed report to the Data Protection Board within 72 hours once it applies in May 2027, so plan for it now. Also, entities covered by the April 2022 CERT-In Directions must report incidents within 6 hours.

Quick checklist

• ☐ Ran pip show brotli brotlicffi in every Python environment
• ☐ Upgraded Node.js, Bun, Envoy and Istio to fixed versions
• ☐ Installed distro brotli updates and restarted dependent services
• ☐ Ran the marker scan on hosts and inside images
• ☐ Rebuilt container images and compiled executables
• ☐ Added a proxy rule refusing Content-Encoding: br where patching lags
• ☐ Listed bundled copies (.NET, DuckDB, Arrow, Pillow, 7-Zip) and tracked vendor fixes
• ☐ Reviewed logs for crashes after Brotli requests

If you would like help finding every HTTP2Shell-affected copy across your servers and images, our Linux server hardening audit covers this kind of inventory. For the Node.js-only details, read our Node2Shell release guide. You can also run a free website safety check.

Sources

• Node.js October 2026 security releases
• google/brotli releases (1.2.1, 1.1.1, 1.0.10)
• GitHub advisory GHSA-9v8h-qqgm-4m35
• Envoy advisory GHSA-3wvj-j6qm-62mr
• Istio ISTIO-SECURITY-2026-007
• Debian security tracker: CVE-2026-111497
• Red Hat: CVE-2026-111497
• The Hacker News: Brotli decoder flaw also affects Bun, Python and others

Want a second pair of eyes on your DevOps security? Our VAPT services cover CI/CD pipelines, self-hosted tools and how secrets are stored. For servers, see our Linux server hardening & security audit, or contact us.