HTTP2Shell: critical Brotli flaw now exploited, websites urged to patch

Many websites squeeze their pages before sending them to you, and a popular way to do that is Brotli, a compression format created by Google. In late October 2026, a critical flaw was found in the part of Brotli that unpacks that data. Security researchers have nicknamed it “HTTP2Shell”. It is tracked as CVE-2026-111497, and fixes started arriving on October 21.^{1, 2, 3}

Reporting checked October 28, 2026.

Too long; didn’t read?

• Brotli versions 1.0.3 to 1.2.0 can be tricked by malformed compressed data into writing outside their memory, which can crash a program, leak memory contents or let an attacker run code.^{2, 3}
• It mainly affects servers and apps that unpack Brotli data sent by others, such as Node.js websites. Fixes are out.^{1, 3}
• Attackers are now using it: on October 27 the US cybersecurity agency CISA added the flaw to its list of vulnerabilities exploited in real attacks.^{7, 8}
• Ordinary users: install your updates. Website owners: ask your host or developer about CVE-2026-111497 today.

What went wrong

Compression packs data into a smaller form; a decoder unpacks it again. The Node.js project explains that Brotli’s decoder treated a certain kind of invalid input as “send me more data” instead of an error, and kept appending bytes to a tiny eight-byte buffer, a small reserved area of memory. Writing past its end corrupts the program’s memory, “which can lead to a crash, disclosure of process memory, or remote code execution”.¹

The GitHub security advisory rates the flaw critical (9.2 out of 10) and says it can be triggered by “a remote unauthenticated attacker”, meaning someone who doesn’t need an account or password.² Node.js credits researchers from OpenAI’s Codex Security team with reporting it.¹

Despite the name, the problem is not limited to HTTP/2. BleepingComputer reports that it affects any application that decompresses Brotli data an attacker can control, and that it is also called “Node2Shell” because it was first found in Node.js, the software that runs many websites.³

How serious is it right now?

According to BleepingComputer, security firm Imperva confirmed that running an attacker’s code is possible, and proof-of-concept exploits have been published. As of October 26, there were no reports of malicious attacks using the flaw.³

Update, October 28: That has changed. On October 27, CISA, the US Cybersecurity and Infrastructure Security Agency, added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog “based on evidence of active exploitation”.⁷ BleepingComputer reports that CISA confirmed hackers have begun exploiting the flaw.⁸ If you run a website or server that uses Node.js or Brotli, patching can’t wait.

YouTuber Mutahar (SomeOrdinaryGamers) explains the bug in roughly the first ten minutes of this video. It is opinionated commentary with strong language, and the later part of the video moves on to other topics.

Who has released fixes

• Brotli itself: versions 1.0.10, 1.1.1 and 1.2.1, released from October 21. The Python packages are fixed in brotli 1.2.1 and brotlicffi 1.2.1.0.^{2, 3, 4}
• Node.js: 22.23.4, 24.22.1 and 26.12.1.^{1, 3}
• Microsoft .NET: an emergency update released on Sunday, October 25.³
• Envoy (a proxy used by many large websites): 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, for setups that decompress Brotli.⁵
• Ubuntu: fixed packages for 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10, installed with a normal system update.⁶

One catch: BleepingComputer warns that updating the system’s Brotli library does not protect programs that ship their own built-in copy, such as Node.js. Each of those needs its own update.³

What you can do

If you just use websites and apps: there is nothing special to do beyond installing updates for your browser, phone, computer and apps when they are offered. The risk sits mainly with the companies running servers.

If you run a website or online shop:

• Send your hosting company or developer the CVE number, CVE-2026-111497, and ask them to confirm in writing that the web server, any proxy, and the application (Node.js, .NET, Python packages) are on fixed versions.
• Ask specifically about apps that bundle their own copy of Brotli, since a system update alone won’t cover them.³
• Restart services after updating so the fixed code is actually running.
• If you use a Linux server yourself, check your distribution’s security notice and run a full system update.⁶

Sources

1. Node.js, October 21, 2026: October 2026 security releases
2. GitHub Advisory Database, October 22, 2026: Out-of-bounds write in the Brotli decoder
3. BleepingComputer, October 26, 2026: Critical ‘HTTP2Shell’ Brotli vulnerability triggers emergency patches
4. Google Brotli, October 21, 2026: Release v1.2.1
5. Envoy, October 23, 2026: Out-of-bounds write in Brotli decompressor
6. Ubuntu, October 26, 2026: USN-8956-1: Brotli vulnerability
7. CISA, October 27, 2026: CISA adds two known exploited vulnerabilities to catalog
8. BleepingComputer: CISA warns of hackers now exploiting critical Node2Shell flaw