Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical memory corruption vulnerability in Google's Brotli data compression library has triggered emergency security updates across multiple runtime environments after researchers confirmed it enables remote code execution. Tracked as CVE-2026-111497 and dubbed HTTP2Shell, Node2Shell, and Broccoli2Shell, the flaw resides in the open-source C decoder built into Node.js, according to BleepingComputer's report. The defect impacts applications decompressing untrusted Brotli data across servers and client applications, prompting emergency fixes from Google, Node.js, Microsoft, and Python package maintainers.

This report details the technical buffer overflow mechanism, affected library versions across Node.js, Python, and .NET, defensive remediations, and residual security risks. It is written for backend engineers, systems architects, and infrastructure operators managing services that decompress incoming Brotli traffic or parse compressed external HTTP responses. Engineering teams must evaluate whether their edge proxies, application runtimes, and external fetch utilities handle Brotli streams that could allow external attackers to corrupt memory, expose sensitive data, or compromise host processes.

What broke in Critical 'HTTP2Shell' Brotli vulnerability

The core defect stems from a memory corruption vulnerability inside the C decoder library of Brotli, an open-source project developed and maintained by Google for lossless web data compression. In unpatched vulnerable releases, the decoder encounters a specifically crafted compressed stream that triggers an invalid block switch. Rather than halting execution with a format error, the streaming decoder accepts the sequence as valid and misinterprets the structure as an indication that the parser requires additional input bytes before concluding its decompression processing.

This misinterpretation causes the decoder to append incoming data bytes continuously into an internal buffer allocated for only eight bytes. Writing past this boundary triggers a buffer overflow that corrupts surrounding memory. While maintainers committed initial fixes into the upstream repository in February, stable patches and coordinated public disclosure arrived on October 21 and October 22. Independent security firm Imperva verified that exploiting this Node2Shell vulnerability corrupts active memory and can lead to arbitrary remote code execution on vulnerable target hosts.

Who is exposed by Critical 'HTTP2Shell' Brotli vulnerability

The security defect affects upstream Google Brotli library versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0, creating systemic exposure across environments that decompress attacker-controlled Brotli data. Node.js was the first platform where researchers flagged the flaw because the runtime embeds the vulnerable C decoder directly. Microsoft pushed an emergency security update on Sunday for .NET, warning that successful exploitation permits privilege escalation on systems running a vulnerable .NET version. Although named HTTP2Shell, the flaw is not specific to HTTP/2 and impacts any service handling compressed Brotli payloads.

The exposure footprint also covers the Python ecosystem when applications configure HTTP clients with a vulnerable Brotli decoder. Impacted packages include urllib3 with brotli support, requests, httpx, and aiohttp with speedups, alongside other tools relying on native Brotli implementations. Systems acting as HTTP clients encounter danger when fetching external URLs from remote servers that return compressed responses. A dedicated online tracking portal warned administrators that upgrading host system libraries fails to protect Node.js instances and containerized applications that rely on their own internally bundled copies of the decoder.

What to do now about Critical 'HTTP2Shell' Brotli vulnerability

Infrastructure operators must deploy patched software releases across all impacted software layers. Upstream Google Brotli releases containing fixes are versions 1.0.10, 1.1.1, and 1.2.1. Node.js users must upgrade to version 22.23.4, 24.22.1, or 26.12.1. Python developers should install Brotli 1.2.1 or brotlicffi 1.2.1.0, which became available on PyPI on October 23. After installing these updates, administrators must restart all affected running processes and rebuild and redeploy all application container images to guarantee that vulnerable bundled libraries are completely replaced across active production environments.

When immediate patching is not possible, security teams should implement interim mitigations to reduce their attack surface. Organizations can remove Brotli compression support from Python applications and block incoming Brotli-compressed requests at firewalls or reverse proxies. However, administrators must remember that blocking inbound requests does not mitigate outbound risks, leaving applications exposed if they fetch malicious HTTP responses from external servers. Because proof-of-concept exploits are already public, applying verified package updates, rebuilding containers, and restarting services remains the only reliable method to eliminate exploitation risks.

How the Critical 'HTTP2Shell' Brotli vulnerability issue works

The flaw operates as a heap buffer overflow triggered during streaming decompression routines. When an application feeds a specially crafted compressed stream into the Brotli decoder, it encounters an invalid block switch. Node.js explained that an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. Because bounds checking fails after this invalid state, the decoder continually writes data past the eight-byte limit into neighboring memory.

Attackers can deliver malicious data through two primary interaction patterns. A threat actor can send a compressed request directly to an exposed HTTP server configured to decompress request bodies. Alternatively, an attacker can set up a web server that returns a crafted compressed response to an application fetching remote URLs. Once the decoder begins streaming input into memory, the resulting corruption can crash the application process, expose internal memory contents, or allow the attacker to execute arbitrary code within the context of the host process.

What is still unknown about Critical 'HTTP2Shell' Brotli vulnerability

Although security researchers have developed and published working proof-of-concept exploits for Node2Shell, there are currently no verified reports of active exploitation in the wild. It remains unclear how many enterprise deployments continue running vulnerable bundled Brotli libraries inside unmonitored container images or legacy services. While upstream developers committed patches to the Brotli source code in February, the eight-month gap before Google and Node.js issued coordinated public releases in late October leaves open questions regarding when downstream maintainers were first notified of the issue.

The full inventory of third-party network tools and microservices that silently embed vulnerable Brotli decoder versions without explicit administrative visibility also remains unknown. Security teams must account for defensive limitations once an attacker gains an initial foothold, as industry research notes that defensive controls block only 37 percent of actions after attackers obtain valid credentials. As organizations audit their environments, the speed with which administrators patch container images and restart active services will determine whether published proof-of-concept code translates into real-world attacks.