Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)
Severity: critical · Patch status: partial · Since 2026-10-22 · CVE-2026-111497
An out-of-bounds write in Google's Brotli decoder (versions 1.0.3 to 1.2.0) lets anyone who can make a program decompress attacker-controlled Brotli data corrupt its memory, leak data, crash it or run code. Node.js disclosed it on October 21 as "Node2Shell": servers that decompress request bodies (Express 5, body-parser 2.x) and apps whose fetch() receives Brotli responses from a malicious or compromised server are exposed. By October 23 it was clear the same flaw reaches Python (the Brotli and brotlicffi packages that requests, httpx and aiohttp load automatically), libbrotli, curl, Bun, Envoy and Istio, hence "HTTP2Shell". OpenAI found the bug in February; it was fixed in Brotli source then but not recognised as a vulnerability or released until now, so every project bundling Brotli has to ship its own update. Researchers have shown code execution against an unmodified Node.js image; no exploitation in the wild has been reported. Advisory databases were slow to map the CVE to the PyPI packages, so dependency scanners may not flag them yet.
What to do
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 (or newer in the same line) and rebuild container images; Node.js 25.x, 23.x, 20.x and older get no fix
- Upgrade Python Brotli to 1.2.1+ and brotlicffi to 1.2.1.0+ wherever installed, including inside images; do not rely on scanners flagging it
- Upgrade Bun to 1.4.4+, Envoy to 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8, Istio to 1.29.9 / 1.30.6 / 1.31.2, and libbrotli to 1.2.1 (or patched 1.1.1 / 1.0.10); install OS vendor Brotli updates
- Where no patch is available yet, disable Brotli decoding of untrusted input (request bodies, outbound fetch responses)
Fixed versions
- libbrotli 1.2.1 (also 1.1.1, 1.0.10)
- Node.js 22.23.4, 24.22.1, 26.12.1
- Bun 1.4.4
- Brotli (PyPI) 1.2.1, brotlicffi 1.2.1.0
- Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8
- Istio 1.29.9, 1.30.6, 1.31.2
Sources
All live incidents on Threat Watch
