HTTP2Shell: Brotli decoder CVE

The bug

What it is

An out-of-bounds write in the decoder of Brotli, Google's compression library, versions 1.0.3 to 1.2.0 (CVE-2026-111497). Runtimes and packages use it to unpack Brotli-compressed HTTP data.
Fixed upstream in 1.0.10, 1.1.1 and 1.2.1, all released 2026-10-21.
Every runtime, package or library that bundles or links that decoder inherits it.

Impact

Remote code execution, memory leaks or crashes. The CVE record rates it 9.2 Critical (CVSS 4.0). Node.js and Microsoft rate it High.
Under active attack. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-27.
No login needed. Any app that decodes attacker-supplied Brotli is reachable: a request body sent with Content-Encoding: br (Express 5, Koa body parsers, node:zlib) or a response fetched from a server the attacker controls (fetch(), Python urllib3, httpx, aiohttp). Clients are exposed as well as servers.
Code execution is proven on stock Node.js 24.22.0. Failed attempts crash the process, and each build needs its own offsets.

Names

Node2Shell: the flaw in the Node.js runtime, reached through Brotli request bodies.
HTTP2Shell: the flaw in any HTTP client or server that decodes Brotli, such as Python's urllib3, requests, httpx and aiohttp via the Brotli and brotlicffi packages. Unrelated to HTTP/2.
Python2Shell: the flaw in Python's Brotli and brotlicffi packages, which compile the same C decoder.
Brotli2Shell, Broccoli2Shell, Brotlipocalypse: names for the decoder flaw itself.

Exploitation

Attacks started within a day of disclosure. Vendor sensors have logged attempts from at least 20 IPs since 2026-10-21.
No confirmed compromise yet. ELLIO replayed a captured exploit chain 50 times in a lab and got no shell.
Public exploit code has been out since 2026-10-22.

Related

The pure-Go andybalholm/brotli has the same flaw, but in Go it can only crash the process. Fixed in v1.2.7. See the Go row.

Manual checks

Any row that matches means you are affected.

Stack	Check	Affected if	Fix
Node.js	`node --version`	22.x below 22.23.4 24.x below 24.22.1 26.x below 26.12.1 Any 20.x, 23.x, 25.x or older (no fix)	22.23.4, 24.22.1 or 26.12.1 Move end-of-life lines to a supported one
Bun	`bun --version`	1.0.21 to below 1.4.4	1.4.4 Rebuild `bun build --compile` binaries
.NET	`dotnet --list-runtimes` compare runtime versions	8 below 8.0.33 9 below 9.0.22 10 below 10.0.14 11 previews and RCs before 11.0.0-rc.3.26522.148	8.0.33, 9.0.22 or 10.0.14 11.0.0-rc.3.26522.148 Rebuild self-contained and NativeAOT apps
Python	`pip list 2>/dev/null \| grep -iE '^(brotli\|brotlicffi\|curl[-_]cffi) '` in every venv	`Brotli` below 1.2.1 `brotlicffi` below 1.2.1.0 `curl_cffi` below 0.17.0	1.2.1 1.2.1.0 0.17.0
Java	`mvn dependency:tree -Dincludes=com.aayushatharva.brotli4j` `./gradlew -q :app:dependencyInsight --dependency com.aayushatharva.brotli4j --configuration runtimeClasspath` once per module, replacing `:app`	`brotli4j` 1.23.0 or earlier `jvmbrotli`, any version	1.24.0 for `brotli4j` and every `native-*` artifact Replace `jvmbrotli`
Ruby	`grep -E '^ brotli \(' Gemfile.lock`	`brotli` gem 0.2.1 to 0.9.0	0.9.1
Go	`go list -m all \| grep brotli`	`andybalholm/brotli` below v1.2.7 (same flaw, crash only) `google/brotli` (cbrotli) links the build host's libbrotli: check the Linux rows	`andybalholm/brotli` v1.2.7 cbrotli: patch the OS library and restart Rebuild if linked statically or shipped in an image Bazel: move `@org_brotli` to 1.2.1 and rebuild
Rust	`grep -i brotli Cargo.lock`	`brotlic-sys` 0.2.2 or earlier (via `brotlic` 0.8.2 or earlier) `compu-brotli-sys` 1.2.1 or 1.0.10 Any other `-sys` crate that vendors an unfixed decoder Not affected: pure-Rust `brotli`, `brotli-decompressor`	Move to the pure-Rust crates No fixed `-sys` release on crates.io
Debian / Ubuntu	`dpkg -l \| grep brotli`	Debian bookworm: below 1.0.9-2+deb12u1 Debian trixie: below 1.1.0-2+deb13u1 Debian forky: no fix yet Debian sid: below 1.2.0-4.1 Debian bullseye: below 1.0.9-2+deb11u1 (Freexian ELTS, paid) Debian buster: below 1.0.7-2+deb10u2 (Freexian ELTS, paid) Ubuntu 26.10: below 1.2.0-4ubuntu0.1 Ubuntu 26.04: below 1.2.0-3ubuntu0.1 Ubuntu 24.04: below 1.1.0-2ubuntu0.1 Ubuntu 22.04: below 1.0.9-2ubuntu0.1 Ubuntu 20.04: below 1.0.7-6ubuntu0.1+esm1 (Ubuntu Pro) Ubuntu 18.04: below 1.0.3-1ubuntu1.3+esm1 (Ubuntu Pro) Ubuntu 16.04: below 1.0.3-1ubuntu1~16.04.2+esm1 (Ubuntu Pro)	Security update Restart what links it
Other Linux	`rpm -qa \| grep brotli` `apk info -v \| grep brotli` `pacman -Q brotli`	Upstream 1.0.3 to 1.0.9, 1.1.0 or 1.2.0 Fedora, Arch, Alpine 3.21+, openSUSE Tumbleweed: the version is enough (they ship 1.1.1 or 1.2.1) Alpine 3.20 and 3.19: no fix Fedora 43: fix in updates-testing only RHEL, AlmaLinux, Amazon Linux, SLE: compare the release string (see notes)	RHEL 10: `1.1.0-8.el10_2.1` RHEL 9: `1.0.9-10.el9_8.1` RHEL 8: `1.0.6-5.el8_10` Amazon Linux 2023: `1.1.0-1.amzn2023.0.2` SLE 15: no released fix yet Restart what links it

.NET: Microsoft also lists PowerShell 7.4, 7.5 and 7.6 (fixed in 7.4.22, 7.5.13 and 7.6.9) and Visual Studio 2019 16.11 (16.11.61), 2022 17.14 (17.14.43) and 2026 18.11 (18.11.2). Visual Studio 2017 15.9 has no fixed build listed.
Python: Scrapy, flask-compress, selenium-wire and django-compression-middleware depend on Brotli directly. urllib3 (and so requests), httpx and aiohttp pull it in only through extras (urllib3[brotli], httpx[brotli], aiohttp[speedups]). They still decode Brotli whenever it is importable. pipdeptree -r -p Brotli,brotlicffi --extras active (pipdeptree 3.0+) shows what pulls it in.
Python wheels with their own Brotli: Pillow 13.0.0 wheels bundle libbrotli 1.2.0, and no fixed Pillow release exists yet. duckdb vendors an unfixed Brotli 1.1.0 decoder. The pip versions of these packages don't map to Brotli versions.
Distro-installed python3-brotli shows the upstream version even after patching. Use the OS row.
Java: jvmbrotli (com.nixxcode.jvmbrotli) is abandoned and bundles Brotli 1.0.7. Replace it.
Ruby: from 0.4.0 the brotli gem links the system libbrotli if libbrotli-dev was present at install. Those builds are fixed by the OS update.
Go cbrotli has no C code of its own. cgo links the build host's libbrotli, so patch the OS library and restart. Bazel builds compile @org_brotli from source, so move that to 1.2.1 and rebuild.
Rust: brotlic-sys bundles Brotli 1.0.9. compu-brotli-sys 1.2.1 and 1.0.10 bundle the unfixed 1.2.0 and 1.0.9 decoders despite their version numbers. Its only fixed release, 1.2.0, is yanked. Judge any other -sys crate by its vendored source: fixed code contains BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. Grep Cargo.lock, because plain cargo tree shows only the host target.
Debian's nodejs package, and Ubuntu's on 22.04 and later, use the system libbrotli, so node --version alone tells you nothing there. Check the Debian / Ubuntu row. Ubuntu 20.04's nodejs 10.19 bundles its own Brotli and has no fix. Updating libbrotli1 doesn't cover it.
Debian bookworm has no fixed build for armel, mips64el, mipsel or s390x.
RHEL, AlmaLinux, Amazon Linux and SLE keep the old version number when they patch, so compare the full release string (e.g. 1.0.9-10.el9_8.1) against the vendor tracker, not the upstream version.
Bundled copies on RPM distros: some packages bundle their own Brotli and won't show in rpm -qa | grep brotli. These include Firefox, Thunderbird, the RHEL 8/9 nodejs:24 and nodejs:26 modules, and on SUSE ghostscript, qemu, ovmf, texlive and mozjs.
Scanners stay silent for several of these. Bun, Brotli4j, the Ruby gem, curl_cffi, andybalholm/brotli and the Rust -sys crates have no entry in the GitHub Advisory Database, OSV, the Go vulnerability database or RustSec. Dependabot, OSV-Scanner, govulncheck, bundler-audit and cargo audit won't flag them.
Containers: run the same checks inside every image you ship, for example docker run --rm --network=none <image> node --version (or podman run). Updating the host does not fix an image. Rebuild it.

Vendored Brotli source

If you vendor Brotli's C source, fixed code contains the error name BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. This lists decoder files that lack it:

grep -rIlZ --include='decode.c' --include='decode.cpp' 'BrotliDecoderDecompressStream' . |
  xargs -0 -r grep -L 'BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH'

Copies older than 1.0.3 also show up but are not affected.

The Debian and Ubuntu security patches add the same error name. Compiled libraries show it as _ERROR_FORMAT_BLOCK_SWITCH (1.1 and later) or a bare BLOCK_SWITCH (1.0.x). Still judge OS packages by version.

Automated checker

Source on GitHub

We provide a free script that runs every check on this page against one machine in a single pass. With -c it also checks local Docker or Podman images. It reads files and makes no changes. Usage is in the repository README.

git clone https://github.com/fieldse/brotli-node2shell-check.git
cd brotli-node2shell-check
less scripts/vuln-check-CVE2026-111497-brotli.sh   # review before running

View the script source: vuln-check-CVE2026-111497-brotli.sh.

./scripts/vuln-check-CVE2026-111497-brotli.sh -r ~/src -q    # scan a source tree and report problems only
./scripts/vuln-check-CVE2026-111497-brotli.sh -r /srv -c     # also check local Docker or Podman images
./scripts/vuln-check-CVE2026-111497-brotli.sh -c -e podman   # set the engine (by default Docker, then Podman)
./scripts/vuln-check-CVE2026-111497-brotli.sh --help

FAIL: A known-vulnerable version is present.
WARN: Needs manual review.

The script exits 1 on any FAIL. With --strict it also exits 1 on any WARN, so it can gate CI.

See how the script is tested.

If you can't upgrade today

Reject request bodies with Content-Encoding: br at your proxy or gateway. This doesn't protect code that fetches Brotli responses from user-supplied URLs, so upgrade as soon as you can.

Sources

Versions on this page come from these advisories, checked on 2026-10-29.

Every version claim with its source

Resources

Write-ups for background, exposure paths and detection.

OpenSourceMalware: CVE-2026-111497 Brotli bug reaches far beyond Node.jsInventory of projects that bundle their own Brotli copy, and the fix-marker string.
OpenSourceMalware: Python packages vulnerable to Node2ShellAffected PyPI packages and how to find them.
Socket: eMudhra, Brotli, and the long tail of a security fixWhy vendored copies keep the bug alive after the upstream fix.
Aikido: Node2Shell, Node.js Brotli RCEThe Node.js case and its exposure paths.
Aikido: Python packages vulnerable, evolves to HTTP2ShellWhere the HTTP2Shell name comes from.
Wiz: Broccoli2Shell, everything you need to knowOverview across Node.js, Bun, Envoy and more.
Sysdig: Detecting the Node.js Brotli RCERuntime detection.
Tenable: Brotli2Shell FAQCommon questions, via Security Boulevard.
broccoli2shell.comCommunity tracker of affected projects.
Blacklight SecurityPenetration testing, managed SOC and incident response in Australia and New Zealand.