A critical flaw, initially identified in **Node.js** but now understood to be rooted in the **Brotli** C decoder library, poses a significant threat across multiple software ecosystems. The vulnerability, tracked as **CVE-2026-111497**, could allow attackers to corrupt memory and access sensitive data. ### The 'HTTP2Shell' Threat Known by several monikers including 'HTTP2Shell,' 'Broccoli2Shell,' and 'Node2Shell,' this security issue affects **Brotli** versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. **Brotli**, an open-source project developed and maintained by **Google**, is widely used for lossless data compression, enabling faster file transmission. The name 'HTTP2Shell' highlights its potential impact on HTTP clients and servers, though the vulnerability is not exclusive to HTTP/2 and can affect any application decompressing attacker-controlled **Brotli** data. ### Widespread Impact and Affected Software Beyond **Node.js**, other potentially affected software includes Python HTTP clients such as *urllib3[brotli]*, *requests*, *httpx*, and *aiohttp[speedups]*, when configured with a vulnerable **Brotli** decoder. Any application or tool leveraging vulnerable **Brotli** implementations is at risk. **Microsoft** recently released an emergency security update to address the flaw in **.NET**, warning that successful exploitation could lead to privilege escalation on systems running vulnerable **.NET** versions. ### Understanding the Buffer Overflow **CVE-2026-111497** is a buffer overflow vulnerability. It occurs when a specially crafted **Brotli**-compressed stream triggers an invalid block switch. The decoder misinterprets this as a temporary need for more input, continuously appending input bytes to an internal eight-byte buffer. This process eventually extends beyond the buffer's bounds, corrupting adjacent memory. As explained by **Node.js** in their advisory, "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer." Attackers can exploit this by inducing an application to decompress malicious data, for instance, by serving a compressed HTTP response to an application fetching a URL, or by directly sending a compressed request to a server. **Node.js** warns that this can lead to process crashes, memory exposure, and even remote code execution (RCE). Cybersecurity firm **Imperva** has confirmed that exploiting **CVE-2026-111497** can indeed result in RCE. ### Urgent Patching and Mitigation While the upstream **Brotli** fixes were committed in February, stable fixes for users were released by **Node.js** and **Google** on October 21, followed by public disclosure the next day. PyPI packages containing the fixes became available on October 23. **Patched versions include:** * **Google Brotli** 1.0.10, 1.1.1, 1.2.1 * **Node.js** 22.23.4, 24.22.1, 26.12.1 * **Python Brotli** 1.2.1 * **Python brotlicffi** 1.2.1.0 Proof-of-concept (PoC) exploits for **Node2Shell** have been published, though there are no reports of malicious exploitation in the wild yet. Nevertheless, users must prioritize applying these security updates immediately. After updating, administrators must restart affected processes, and any affected container images require rebuilding and redeployment. A dedicated online portal tracking the flaw's impact warns that merely updating the system **Brotli** library is insufficient for **Node.js** deployments or other applications that bundle their own copy of the library. Furthermore, simply blocking inbound **Brotli** requests does not mitigate the risk from malicious HTTP responses. If immediate updating is not feasible, alternative recommendations include removing **Brotli** support from Python applications and blocking incoming **Brotli**-compressed requests at the proxy or firewall level.