Brotli Flaw 'HTTP2Shell' Exposes Node.js and .NET Servers
Software ecosystems are racing to deploy patches after security researchers discovered a critical memory corruption vulnerability in Google's Brotli compression library. Tracked as CVE-2026-111497, the flaw enables remote code execution across millions of servers running Node.js, .NET, and popular Python web libraries.
How an 8-byte buffer slip created the HTTP2Shell Brotli flaw
The vulnerability stems from a subtle logic error inside Brotli's streaming decoder. When handling an invalid block switch, the decoder treated the issue as an intermittent request for more input data rather than terminating on a permanent format error.
Because of that misinterpretation, the engine kept appending incoming bytes to an internal buffer measuring just eight bytes. That out-of-bounds write corrupts process memory. Depending on the architecture and compiler flags, an attacker feeding weaponized compressed payloads can force service crashes, leak memory contents, or achieve full remote execution inside web runtimes.
CVE-2026-111497 (HTTP2Shell): vulnerability details and patches
| Spec | Detail |
|---|---|
| CVE identifier | CVE-2026-111497 |
| CVSS score | 9.2 (Critical) |
| Vulnerability type | Out-of-bounds write / Buffer overflow |
| Patched Brotli versions | 1.0.10, 1.1.1, 1.2.1 |
| Affected Node.js branches | 22.x, 24.x, 26.x |
| Exploit status | Public PoC available (GitHub) |
| Active in-the-wild attacks | Not confirmed yet |
The blast radius: Node.js, .NET, and Python
Because Brotli is the default compression format across high-throughput web traffic, its footprint spans deeply embedded infrastructure. The risk echoes recent server headaches, including friction surrounding the PHP ecosystem's handling of critical vulnerabilities.
Upstream fixes arrived from Google on October 21 across Brotli versions 1.0.10, 1.1.1, and 1.2.1. However, updating the base C library is only the first step. Frameworks that bundle their own decoders—notably Node.js via its node:zlib implementation, Microsoft's .NET, and edge proxies like Envoy—require distinct vendor updates.
Community tracking portal Broccoli2Shell confirmed that functional proof-of-concept code emerged on GitHub within 24 hours of disclosure. While existing exploit code only achieves arbitrary execution against deliberately weakened builds, standard environments still suffer denial-of-service crashes and memory leakage.
The dangerous aspect of HTTP2Shell is the false sense of security created by OS-level patch managers. If your deployment bundles Brotli directly inside container runtimes or statically linked workers, standard server patching does nothing. Treat this as a rebuild mandate, not a simple package upgrade.
Mitigation steps beyond base package updates
Simply running a package manager update on your host operating system will leave services exposed if underlying container layers or statically linked binaries remain untouched.
Teams unable to immediately cycle production services can apply temporary mitigations at ingress points, though downstream services fetching external web resources remain susceptible.
- Rebuild container images using updated base dependencies and restart active daemon processes.
- Configure load balancers and web application firewalls to block inbound requests containing Brotli-compressed body payloads.
- Strip optional decoding dependencies in Python stacks by uninstalling brotlicffi or downgrading extras such as httpx[brotli].
Availability and patching roadmap
Official patches are live globally across all supported platforms. Node.js pushed fixed releases on October 21, Microsoft deployed updates for supported .NET channels over the following weekend, and PyPI mirrors published patched wheels on October 23.
DevOps and security teams in North America and Europe should treat container redeployment as urgent: edge proxies and ingress controllers will remain exposed until running memory spaces are cycled.
Frequently asked questions
What is the HTTP2Shell vulnerability?
Tracked as CVE-2026-111497, it is a critical out-of-bounds write flaw in the Brotli decompression engine. It allows maliciously formatted compression streams to overflow an internal buffer, causing crashes, memory leaks, or remote code execution.
Are there active attacks exploiting Brotli CVE-2026-111497?
Active in-the-wild exploitation has not been confirmed yet, but functional proof-of-concept code is publicly available on GitHub, increasing the urgency for immediate patching.
Which Node.js versions are affected by HTTP2Shell?
The vulnerability affects Node.js versions across the 22.x, 24.x, and 26.x release lines that utilize the built-in node:zlib decompression routines.
Sources
- Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites | TechRadar. techradar.com, 2026. https://www.techradar.com/pro/security/microsoft-and-others-scramble-to-patch-http2shell-flaw-which-could-be-the-next-php-level-issue-node-js-problem-may-also-affect-millions-of-sites
- Last Week’s Critical PHP Warning Was the Tip of the Web Vulnerability Iceberg. cnet.com, 2026. https://www.cnet.com/tech/services-and-software/php-warning-web-vulnerability/