Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

HTTP2Shell is the name given to a critical flaw in Brotli’s C decoder. It is tracked as CVE-2026-111497 and is also called Broccoli2Shell or Node2Shell. The flaw matters because applications may decompress attacker-controlled data, allowing memory corruption and potentially remote code execution.

The vulnerability affects Brotli versions 1.0.3 through 1.0.9, plus versions 1.1.0 and 1.2.0. A specially crafted compressed stream triggers an invalid block switch. The decoder treats that condition as a temporary request for more input instead of a permanent format error, then keeps writing into an internal eight-byte buffer.

The issue was first identified in Node.js, but researchers found the same decoder flaw could affect multiple ecosystems. Fixed releases include Google Brotli 1.0.10, 1.1.1, and 1.2.1, along with patched Node.js and Python packages. Users should update and restart affected processes.

The vulnerability could have broad reach because Brotli is not limited to one product or ecosystem. It is built into Node.js, can affect .NET deployments, and may be used by Python packages and HTTP clients. Other software and tools that use vulnerable Brotli implementations may also be exposed.

Examples include urllib3[brotli], requests, httpx, and aiohttp[speedups] when configured with a vulnerable decoder. An attacker can supply malicious compressed data through an application that fetches a URL or through a server accepting compressed requests. The decoder then processes the crafted stream and may corrupt nearby memory.

The article does not establish that every listed application is vulnerable. Exposure depends on the Brotli version and whether an application uses its own bundled copy. Updating a system library alone may not fix Node.js deployments or other applications with bundled Brotli, so each affected component needs attention.

When an application decompresses a malicious Brotli stream, the decoder may write beyond an internal buffer and corrupt nearby memory. That corruption can crash the application or expose data stored in memory. Node.js also warns that successful exploitation can enable remote code execution, giving an attacker a path to run code on the affected system.

For example, an attacker could serve a compressed HTTP response to an application that fetches a URL. The application decompresses the response, and the crafted stream triggers the decoder’s invalid block-switch handling. The decoder keeps appending bytes after the eight-byte buffer is full, causing an out-of-bounds write.

The article reports that Imperva confirmed the Node2Shell vulnerability can lead to RCE. Proof-of-concept exploits have been published, but there are no reports of malicious exploitation in the wild. Available updates should still be prioritized, followed by process restarts and container rebuilds.

Brotli compressed data is processed as a stream of blocks. In this flaw, a specially crafted stream contains an invalid block switch. Instead of rejecting that switch as a permanent format error, the streaming decoder reports that it temporarily needs more input.

That mistaken status changes what the decoder does next. It continues accepting and appending input bytes to an internal buffer that holds only eight bytes. Once the buffer is full, further writes continue past its end. Those out-of-bounds writes can corrupt nearby memory and produce crashes, memory exposure, or more serious consequences.

The issue is therefore not simply that the compressed data is malformed. The dangerous behavior comes from how the decoder handles the malformed condition. The upstream Brotli project committed fixes in February, and stable fixes were released by Google and Node.js on October 21 before public disclosure the next day.

The flaw is not limited to one direction of HTTP traffic. A server may decompress a compressed request sent by an attacker. A client may also fetch a URL and decompress a malicious compressed response served by an attacker. In either case, the vulnerable component receives the crafted Brotli stream.

The key mechanism is the decoder, not HTTP/2 itself. The stream triggers an invalid block switch, which the decoder misreads as a temporary need for more input. It then continues appending bytes to its internal eight-byte buffer, writing beyond the buffer and potentially corrupting memory.

That is why blocking inbound Brotli requests is not enough. The article specifically warns that the malicious HTTP-response route remains exposed. If immediate updating is impossible, administrators are advised to remove Brotli support from Python applications and block incoming Brotli-compressed requests at a proxy or firewall, while still addressing response-side risk.

Applying a security update does not automatically replace code already loaded by a running process. An affected service may continue using the old Brotli decoder until it is restarted. That is why the article tells administrators to restart affected processes after updating.

Containers create a second persistence problem. A container image may package its own vulnerable Brotli library, or it may preserve outdated application files and dependencies. Updating the host or system library does not necessarily change that image. The image must be rebuilt so the patched dependency is included, then redeployed so running containers use it.

This matters especially because the flaw can be reached through compressed requests or responses. Administrators should check applications individually, including Node.js deployments and software with bundled Brotli copies. The available fixes include patched Google Brotli, Node.js, Python Brotli, and brotlicffi releases, followed by restarts and redeployment.

Lossless data compression reduces a file’s size without changing its contents. After decompression, the result is identical to the original file. This differs from methods that discard detail to achieve smaller sizes. Lossless compression is useful when every byte must remain accurate, such as in software files and other data that must be restored exactly.

Brotli is an open-source compression project developed and maintained by Google. It looks for patterns and repetition in data, then represents that information more efficiently. The compressed result contains enough information for a decoder to reconstruct the original content. The article describes this as shrinking files so they can be transmitted faster without affecting the original data.

Brotli’s decoder performs the reverse operation. It reads the compressed stream and rebuilds the original data. In the vulnerability described here, malformed input abuses that decoding process. The compression idea remains lossless, but the affected decoder mishandles a block switch and writes beyond its internal buffer.