Security ·
HTTP2Shell: critical Brotli compression flaw hits Node.js, Python, Bun and curl
CVE-2026-111497 in Google's Brotli decoder, first known as Node2Shell, has been called HTTP2Shell since 23 October. It affects any application that automatically decompresses Brotli-encoded HTTP responses or requests.
The bug is an out-of-bounds write in the Brotli library, versions 1.0.3 to 1.2.0. Crafted compressed data can corrupt the memory of the process decoding it, leading to a crash, memory disclosure or code execution without authentication. Google, which assigned the CVE, scores it 9.2 under CVSS 4.0, Node.js rates it high and Red Hat gives it 8.1. The fixed Brotli releases are 1.0.10, 1.1.1 and 1.2.1.
The flaw was reported by OpenAI's Codex Security team. A fix landed in the Brotli source code as early as 27 February, but nobody flagged it as a security issue and it never made it into a release. Node.js fixed it in an emergency release on 21 October together with nine other vulnerabilities. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end of life and get no fix.
Python is affected too: the Brotli and brotlicffi packages up to 1.2.0 are loaded automatically by requests and urllib3, by httpx with the brotli extra, and by aiohttp. Brotli 1.2.1 and brotlicffi 1.2.1.0 fix it. Also affected are Bun up to 1.4.3 (fixed in 1.4.4), Envoy and Istio with Brotli decompression enabled, and software that bundles Brotli, such as curl. Apache's standard mod_brotli and Nginx do not decode Brotli by default.
No attacks have been reported in the wild, and on 23 October the US agency CISA assessed exploitation as none. However, Imperva's team ran its own code on an unmodified Node.js 24.22.0 build in a lab, without publishing the exploit. Aikido warns that as of 23 October pip-audit, Dependabot and Safety did not flag the vulnerable PyPI versions, so automated alerts cannot be relied on.
What it means for companies
If you run a web app, API or online shop on Node.js or Python, update the runtime and dependencies today and, crucially, rebuild container images and bundled binaries, because each one carries its own copy of the library. Services that fetch data from third-party servers or accept compressed request bodies are the most exposed. Where you cannot update right away, reject requests with a Content-Encoding of br before they are decoded. Our cyber security and website maintenance services can audit dependencies and roll out the fixes. This is the second AI-found flaw this week after PHP2Shell: if you build custom web applications, budget for regular security updates from the start.
Sources: Node.js security releases, October 2026, The Hacker News, Aikido Security