On 21 October, Node.js shipped a fix for a flaw nicknamed Node2Shell. Within two days it was clear the problem wasn’t really Node.js. It lives in Brotli, the compression code Google publishes and that a large share of the web’s software quietly bundles. By Friday the security company Aikido had given it a wider name: HTTP2Shell.
The flaw, CVE-2026-111497, lets someone who can send compressed data to a vulnerable system crash it, read parts of its memory or, in the worst case, run their own code on it. No login is needed. GitHub rates it critical, at 9.2 out of 10.
Here is what is affected, what to do this week, and why the most interesting thing about it may be who found it.
The short version
- What: a memory-safety flaw in Google’s Brotli decoder, versions 1.0.3 to 1.2.0.
- Impact: a crash, leaked memory or remote code execution, with no authentication.
- Who: anything that decompresses Brotli data it didn’t create itself, in either direction.
- Fixed in: Node.js 22.23.4, 24.22.1 and 26.12.1; Brotli 1.0.10, 1.1.1 and 1.2.1; the Python packages Brotli 1.2.1 and brotlicffi 1.2.1.0; Bun 1.4.4; .NET 8.0.33, 9.0.22 and 10.0.14; and security releases of Envoy and Istio.
- Exploited yet? No attacks in the wild had been reported by 26 October, and it was not in CISA’s catalogue of known exploited vulnerabilities. Researchers have, however, publicly demonstrated code execution against an unpatched Node.js build.
For every fixed version, how to check each stack and how to block Brotli while you patch, see our technical guide to HTTP2Shell.
Sources: Node.js security releases, 21 October 2026, CVE-2026-111497 at NVD, GitHub advisory GHSA-9v8h-qqgm-4m35, Microsoft’s .NET advisory, CISA Known Exploited Vulnerabilities catalogue (version 2026.10.23) and The Hacker News on the Node.js exploit and the wider list of affected software.
Why one bug has three names
Brotli is a compression format. It makes web pages, scripts and API responses smaller in transit, and software unpacks them at the other end. Because it is so useful, it is everywhere, and many products ship their own copy of the decoder rather than relying on the operating system’s.
That is why the names kept changing. Node.js disclosed it first, so it became Node2Shell. The next day, Python’s Brotli packages were confirmed vulnerable too. By 23 October the list included Bun, Envoy, Istio and curl, and Aikido renamed it HTTP2Shell, because anything that speaks HTTP and decodes Brotli could be exposed. Microsoft followed with a fix for .NET on 25 October. It is one flaw with one root cause, and a long tail of products that each have to ship their own fix.
It also works in both directions. A malicious client can attack an unpatched server that accepts compressed requests, and a malicious server can attack an unpatched client that accepts compressed responses.
Sources: Aikido: Node2Shell evolves to HTTP2Shell and Patch the Planet: Brotli guidance.
An AI found it, eight months ago
The Node.js advisory credits the report to OpenAI’s Codex Security team, and OpenAI says it found the flaw in February. The underlying bug was fixed in Brotli’s source code at the time, but nobody recognised it as a security issue, and no release shipped the fix until this month. Every product that bundled the old code stayed vulnerable in the meantime.
It is part of a pattern. This month, OpenAI’s Patch the Planet initiative also coordinated fixes for critical PHP flaws found with the help of its models, and OpenAI says it expects similar findings “to increase sharply in the coming months”.
That cuts both ways. The same capability that finds a flaw can help someone turn a fresh fix into a working attack, which is why the gap between disclosure and exploitation keeps shrinking.
The flaw sat in shared code for eight months. The fix took three days to outgrow its first name.
Sources: OpenAI: Patch the Planet, 21 October 2026 and Aikido.
Are you affected?
You are likely affected if any of these are true:
- Node.js: you run Node.js 22, 24 or 26 below the fixed versions, or Node.js 20 or older, which gets no fix at all.
- Python: Brotli or brotlicffi is installed anywhere you run Python. Your code doesn’t have to import them: popular HTTP clients such as requests, httpx and aiohttp use them automatically when they are present.
- Infrastructure: you run Bun, or Envoy or Istio with Brotli decompression configured.
- .NET: you run .NET 8, 9 or 10 below the fixed versions and your applications switch on Brotli decompression, which is off by default.
- Browsers and desktop apps: Red Hat lists Firefox and Thunderbird, which embed their own copy of the decoder, and apps built on Electron can bundle more than one. Keep them updating automatically.
- Tools and products: you use curl, or a product that bundles its own copy of Brotli. Check your vendors’ advisories; on 23 October some bundled copies were still reported as unpatched.
Start with the services that data from outside can reach:
- internet-facing services that accept compressed request bodies;
- features that fetch content from servers other people control, such as webhooks, link previews, crawlers and “import from URL”;
- tools that open compressed files from outside your organisation.
Apache and Nginx don’t decode Brotli by default, so a standard setup that only compresses its responses is not exposed through them.
What to do this week
- Find every copy. Check runtimes, dependencies (including the dependencies of your dependencies) and container images. Advisory databases now cover the Python packages, but a scanner won’t see a runtime baked into an image or a decoder bundled inside a product.
- Patch, rebuild and restart. Upgrade to a fixed version, rebuild container images and anything that bundles an affected runtime, then restart every service, worker and scheduled job. A fix in a lockfile does nothing until the running process uses it. On managed platforms, confirm the fix with your provider.
- If you can’t patch yet, stop decoding untrusted Brotli. Reject incoming requests that use Brotli encoding before anything decompresses them, and turn off automatic Brotli decompression in your HTTP clients. Removing Brotli from the encodings a client asks for isn’t enough, because a malicious server can send it anyway. Turning off Brotli compression on your CDN doesn’t help either; that is the other direction.
- Verify from the outside. Check the version that is actually running, not the one you expect, and confirm that any temporary block really rejects Brotli before it is decoded.
- Keep watching. Vendors are still confirming affected products, so check the advisories again before you close the ticket.
Sources: Patch the Planet: Brotli guidance, Node.js and Aikido.
What this says about patching
This is the second “2Shell” this month, after PHP. Both followed the same arc: a flaw deep in shared code, a fix that has to travel through every product that bundled it, and a short window before working exploits appear.
The organisations that handle this well already know three things: what they run, what an attacker can reach, and whether a fix is really live. An annual penetration test answers those questions once a year. Disclosures like this one now arrive every few weeks.
OpenAI calls this moment the defender’s window: a narrowing opportunity to use AI to close security gaps before attackers seize them. The window is real, and it is not staying open.
Source: OpenAI: Daybreak for Frontline Defenders.
How we can help
- Find out if you’re exposed. A Security Posture Assessment maps what you expose to the internet and checks it for published vulnerabilities like this one, confirmed rather than just listed.
- Check your product. An Application & API Penetration Test examines where your application accepts and fetches data from outside, the routes this flaw needs, and with read-only source access, which dependencies sit behind them.
- Prove the fix. Every engagement includes a retest against the original evidence, so “patched” means confirmed, not assumed.
- Be ready for the next one. With Continuous Agentic Red Teaming, critical disclosures are checked against your scope as they are published, and re-tested once you deploy the fix.
This advisory reflects public information on 26 October 2026, when we added .NET and the browser and desktop-app notes. We will update it as vendors confirm more affected products.