Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs

Security teams across multiple software ecosystems expanded emergency patching operations after a severe remote memory-corruption flaw in Google Brotli widened from an isolated runtime concern into an infrastructure-level crisis dubbed HTTP2Shell. Tracked as CVE-2026-111497 with a critical CVSS v4.0 score of 9.2, the defect allows unauthenticated remote attackers to send crafted compressed streams that leak memory, crash processes, or trigger arbitrary code execution. What originally began as Node2Shell following a disclosure by Node.js quickly escalated into a multi-language vulnerability touching Python packages, native C++ runtimes, and major service mesh proxies, as detailed in aikido.dev's report.

This coverage details how an internal decoder flaw discovered earlier this year transformed into a wide-ranging supply chain alert across downstream HTTP clients, gateways, and server proxies. Engineering leads, site reliability engineers, and backend developers responsible for cloud workloads, API gateways, and microservice meshes must evaluate their dependencies to identify vulnerable decompression routines. Because Brotli is a standard compression mechanism for web traffic, both servers processing client request bodies and automated clients parsing remote server responses face exposure until downstream dependencies are locked, rebuilt, and deployed.

Node2Shell evolves to HTTP2Shell: what actually changed

The vulnerability sequence started on Wednesday, October 21, when the Node.js project disclosed CVE-2026-111497 as Node2Shell, warning that any Node.js process decompressing attacker-controlled Brotli content could execute arbitrary code or corrupt memory. At that point, exposure appeared concentrated in JavaScript application servers using built-in decompression through APIs like fetch or common middleware such as body-parser. The dynamic shifted on Thursday when maintainers revealed that standard Python packages sharing the underlying Brotli logic harbored the identical defect, prompting rapid warnings across the Python ecosystem.

By Friday, October 23, researchers recognized that the blast radius extended far beyond individual application runtimes to encompass foundational networking tools and proxies using HTTP compression. The security community renamed the broader threat HTTP2Shell because the vulnerable decoder is embedded directly into service gateways such as Envoy and Istio, alternative runtimes like Bun, and common transfer libraries like libcurl. Upstream Google Brotli maintainers and downstream packagers were forced to coordinate emergency releases, transitioning the issue from a single runtime bug to a ubiquitous web transport risk.

Node2Shell evolves to HTTP2Shell: how it works

At its technical foundation, CVE-2026-111497 is an out-of-bounds write flaw located within the Google Brotli decoder function DecodeBlockTypeAndLength, impacting upstream Brotli versions 1.0.3 through 1.2.0 across all operating platforms. Under normal operation, the decoder processes compressed byte streams while enforcing strict boundary checks against internal working buffers. However, the logic error causes the decoder to continue accepting incoming bytes when it should instead terminate and reject malformed data. These excess incoming bytes overflow an internal working buffer, directly overwriting adjacent execution memory.

An unauthenticated attacker exploits this behavior by delivering a carefully structured Brotli data stream over HTTP. OpenAI discovered the vulnerability in February and determined that the resulting unauthenticated remote code execution operates bidirectionally across client-server boundaries. A malicious client can compromise an unpatched server that decodes compressed request payloads, while a malicious upstream server can take complete control of an unpatched client application that decompresses response bodies. Although the root cause was corrected in upstream Brotli source code in February, it was not flagged as a security vulnerability at that time, leaving consumers without fixed packaged releases until October.

Node2Shell evolves to HTTP2Shell: why it matters now

The severity of HTTP2Shell centers on how silently Brotli decompression operates across standard modern application stacks. Unlike protocol updates that require deliberate manual opt-in, modern networking clients and reverse proxies negotiate Brotli compression transparently to reduce network payloads. In languages like Python, popular HTTP client libraries including requests, httpx, and aiohttp automatically detect and load Brotli or brotlicffi packages whenever those wheels reside in the local environment, activating vulnerable decompression logic without explicit code configuration by the application author.

Compounding the immediate danger, vulnerability scanning tooling experienced visibility gaps during the critical initial disclosure window. As of October 23, public security advisory databases had not yet mapped CVE-2026-111497 to specific PyPI package names, which meant standard audit tools including pip-audit, Dependabot, and Safety did not register alerts for vulnerable libraries in production lockfiles. Organizations that rely purely on automated registry scanning risked assuming clean builds while running vulnerable container images that actively processed untrusted external data streams.

Node2Shell evolves to HTTP2Shell: who is affected

The vulnerable population spans web services, standalone command-line tools, and microservice meshes relying on Google Brotli versions 1.0.3 through 1.2.0. In the Python ecosystem, environments containing Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x or earlier, remain vulnerable through automatic client imports. Runtime environments including Node.js below patched release lines, Bun releases prior to version 1.4.4, and applications statically linking vulnerable builds of curl or libcurl are exposed. Edge proxies and service mesh layers including Envoy versions prior to 1.40.0, 1.39.3, 1.38.6, and 1.37.8, along with Istio versions prior to 1.31.2, 1.30.6, and 1.29.9, require immediate remediation.

Conversely, some common web infrastructure components are safe by default. Standard deployments of Apache HTTP Server using mod_brotli do not decode incoming Brotli payloads and are unaffected by this decompression vector. Similarly, Nginx does not decode Brotli by default. Systems remain shielded if their edge proxies or reverse proxies drop or block compressed payloads before passing traffic to vulnerable application workers, or if their client applications do not parse inbound compressed responses.

Node2Shell evolves to HTTP2Shell: what to watch

Resolving the vulnerability requires upgrading to confirmed fixed releases across every affected layer. Upstream Google Brotli maintainers issued fixed versions 1.0.10, 1.1.1, and 1.2.1. Node.js users must upgrade to versions 22.23.4, 24.22.1, or 26.12.1. Bun environments must advance to 1.4.4, which bundles Brotli 1.2.1. Python operators must pin Brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later. Infrastructure teams running Envoy must deploy 1.40.0, 1.39.3, 1.38.6, or 1.37.8, noting that while 1.36.12 contains the fix, the 1.36 line is unsupported. Istio operators must migrate to 1.31.2 or 1.30.6, as the 1.29 line has reached end of life.

When immediate version upgrades cannot be completed, administrators must apply mitigation controls at perimeter firewalls and application layers. For incoming HTTP traffic, load balancers and middleware should reject any request whose Content-Encoding header contains br, using case-insensitive matching. Outbound clients should remove br from Accept-Encoding headers and configure middleware to reject incoming responses advertising Brotli encodings before decoding starts. Python environments can also uninstall Brotli and brotlicffi to fall back on gzip and deflate algorithms.