HTTP2Shell is a nickname for CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder. It is not a second flaw, and the bug is not in the HTTP/2 protocol. The CVE record lists Brotli 1.0.3 through 1.2.0 as affected and names 1.0.10, 1.1.1 and 1.2.1 as the fixed releases.
Many programs carry their own copy of that decoder, so the fix reaches each one separately. This post lists the stacks we found with a published fix, the version to run and the page that says so. It reflects what those pages said on 24 October 2026 at 18:40 UTC. Node.js details are in our Node2Shell analysis.
Last updated: 24 October 2026, 18:40 UTC. We update this post when vendors publish new fixes.
Is HTTP2Shell a New Vulnerability?
No. Node2Shell came first because Node.js shipped the first fix on 21 October. In our X capture, the first post using that name is from 21 October at 17:08 UTC. “HTTP2Shell” spread after a security vendor’s post on X at 22:26 UTC on 23 October said the vulnerability reached beyond Node.js. Bun’s own post at 00:15 UTC on 24 October used the new name for its advisory.
Open the post on X (@bunjavascript, Bun, 24 October 2026, 00:15 UTC). Our capture holds 229 posts that use the name between 23 October at 16:54 UTC and 24 October at 18:34 UTC. The capture is partial, so read it as a floor.
The CVE record and the Node.js advisory do not use the name. GitHub’s advisory title still says “Node2Shell”. The name is also misleading about where the bug sits. The Node.js advisory explains it: an invalid block switch was reported as a temporary need for more input instead of a permanent format error. The streaming decoder then kept appending input bytes to an eight-byte internal buffer.
So any code that decodes attacker-supplied Brotli data can reach the bug. Red Hat’s page gives two examples: HTTP content negotiated with Content-Encoding: br, and APIs such as the Node.js zlib module and fetch().
Which Runtimes and Libraries Carry the Decoder?
Each row links to the vendor’s own page. A product is listed only where a page says it is affected or fixed.
| Stack and primary page | Fixed version | What the vendor page says |
|---|---|---|
| Brotli library (Google) Brotli v1.2.1 release |
1.0.10, 1.1.1, 1.2.1 | The release notes for all three list CVE-2026-111497 as a security fix. They appeared on 21 October at about 19:27 UTC. |
| Node.js Node.js security releases |
22.23.4, 24.22.1, 26.12.1 | Affects 22.x, 24.x and 26.x. End-of-life lines are always affected when a security release occurs. Fixes exist only for 22.x, 24.x and 26.x. |
| Bun Bun advisory GHSA-663w-cv8g-jj2p |
1.4.4 | Bun 1.4.3 and earlier bundle an affected Brotli (1.4.3 carries 1.2.0). The fetch, node:zlib and DecompressionStream APIs pass data to the decoder. Executables built with bun build --compile stay affected until rebuilt. |
| Python: brotli and brotlicffi GitHub advisory GHSA-9v8h-qqgm-4m35 |
brotli 1.2.1, brotlicffi 1.2.1.0 | Vulnerable from 1.0.3 until the fixed version. GitHub rates the advisory critical. |
| Ruby: brotli gem Project change, pull request 65 |
0.9.1 or later | The gem’s maintainers moved the bundled Brotli to 1.2.1 on 24 October. They also made the gem refuse a system library that lacks the fix. Version 0.9.1 reached RubyGems at 05:31 UTC. |
| Envoy proxy Envoy advisory GHSA-3wvj-j6qm-62mr |
1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | Rated critical, 9.2. Envoy says deployments with the Brotli decompressor configured are affected. |
| ngx_brotli (nginx module) Repository commit |
No release tag; repository updated to 1.2.1 | The module’s Brotli submodule moved to v1.2.1 on 22 October. Its README describes compressing responses and serving pre-compressed files. |
How to read this table. The fixed version belongs to the product, not to the library inside it. Updating a system package does not fix a program that carries its own static copy, such as a Bun executable. The ngx_brotli README describes no step that decodes data from users. That is our reading, not a vendor statement, and we have not tested it. Rebuild with the new submodule when you next ship.
The table leaves out browsers and desktop apps. The table lists only products with a vendor advisory, a fixed release or a published fix commit.
Red Hat lists its Firefox and Thunderbird packages as affected. Mozilla and Google had published no advisory for this CVE on 24 October, so browsers stay out of the table until they do.
Where Do the Linux Distributions Stand?
Distribution pages change by the day, so read the one for your release on the day you patch. This is what they said on 24 October.
| Distribution and primary page | Status | Fixed package |
|---|---|---|
| Debian 12 (bookworm) Debian security tracker | Fixed | brotli 1.0.9-2+deb12u1 |
| Debian 13 (trixie) | Fixed | brotli 1.1.0-2+deb13u1 (DSA-6582-1) |
| Debian forky and sid | Vulnerable | brotli 1.2.0-4, unfixed in unstable |
| Alpine 3.21 Alpine security tracker | Fixed | brotli 1.1.1-r0 |
| Alpine 3.23, 3.24 and edge | Fixed | brotli 1.2.1-r0 |
| openSUSE Tumbleweed SUSE CVE page | Fixed | brotli 1.2.1-1.1, nodejs24 24.22.1-1.1 |
| Red Hat Enterprise Linux 8, 9, 10 Red Hat CVE page | Affected | None listed for brotli, Firefox, Thunderbird or the Node.js streams |
| Ubuntu 16.04 to 26.10 Ubuntu CVE page | Needs evaluation | None listed for brotli or nodejs |
Red Hat rates the vulnerability Important, 8.1 on CVSS 3.1, and lists one fixed product so far: its Hardened Images, with advisory RHSA-2026:87420.
SUSE has released nodejs22 22.23.4 for SUSE Linux Enterprise 15 SP6 and SP7. Its other Node.js packages for SUSE Linux Enterprise and openSUSE Leap are still under analysis.
Debian’s tracker notes that its nodejs package uses the system Brotli library and rates the nodejs entry unimportant. On Debian, the brotli package update is the one that fixes Node.js.
How Real Is the Risk of Remote Code Execution?
The vendors call it remote code execution. Public proof of concept code tells a more mixed story. We read repository descriptions and README files only, ran nothing and link none.
- Public proof of concept codeYesA GitHub search for CVE-2026-111497 returns 38 repositories. They range from version checkers to labs that claim exploit code.24 Oct
- CISA KEV catalogNot seenThe CVE is not in the catalog file released 23 October at 19:30 UTC.23 Oct
- Exploitation in the wildUnknownCISA’s data in the CVE record lists exploitation as “none”. Red Hat says it knows of no public, reliable remote code execution proof of concept.23 Oct
- Talk on XYes229 posts in our capture use the name HTTP2Shell. Nine of them promote a token.24 Oct
One README reports command execution in three Linux x86-64 lab profiles, including a network-only Express 5.3.0 profile. Its author calls the result probabilistic and tied to a pinned Node.js build and an address guess. The same author says the fixed 24.22.1 rejected the request. Other READMEs report crashes only, and two argue that code execution cannot be reached. These are authors’ claims, not findings by Node.js or Google.
A crash alone can take down a service that decodes Brotli from users. The patch order below does not depend on who is right about code execution.
What Should You Patch First?
- Servers that decode Brotli request bodies from the internet. That means Express 5 apps on Node.js 22, 24 or 26, and Envoy with the decompressor configured. An attacker only has to send a request. Red Hat advises not accepting or auto-decoding
Content-Encoding: brfrom untrusted sources where the application allows it. - Clients that fetch from servers you do not control. Bun’s
fetchsendsbrin its default Accept-Encoding header, and Bun says a malicious server can then supply the data. Crawlers, webhook senders and integrations fall in this group. In Bun,decompress: falseturns decoding off for one request. - Build servers and developer machines that run Node.js, Bun or Python and fetch third-party content.
- Unsupported runtimes. Node.js 20 and older have no published fix. Plan a move to a supported line and treat them as exposed until then.
- Linux hosts. Apply the package marked fixed in the table above. Where your distribution lists none, read its page again each day.
How Do You Find Brotli in Your Own Estate?
The decoder hides in three places: a system package, a language package, and a private copy inside a product or image. Check all three.
- System packagesRun dpkg -l ‘brotli*’ on Debian and Ubuntu, apk info brotli on Alpine, and rpm -q brotli on Red Hat and SUSE. Compare with the table.
- Language packagesRun pip show brotli brotlicffi and gem list brotli. A package can be installed only as a dependency of an HTTP client.
- Container imagesRead the version inside each image, not the tag. Rebuild on a patched base and redeploy.
- Software bill of materialsSearch it for brotli, libbrotlidec and the products in the table. A bill made before 21 October still lists the old versions.
- Copies inside productsBun executables built with bun build –compile embed the runtime. Ask vendors which Brotli version their products decode web traffic with.
- Vendored sourceSearch the copy for BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. The fix adds this error code, and the Ruby gem’s change uses it as its test.
A compiled binary may not show that name, so a miss there proves nothing. For the code paths, split the search in two.
- Client side: code that fetches from other servers and accepts
brinAccept-Encoding. In Node.js this includesfetch(). Our Node.js analysis covers it in more detail. - Server side: body parsers that decode
Content-Encoding: brrequests, and gateways with a Brotli decompressor. Express 5 does this by default for JSON bodies.
For Node.js versions, Brandefense Atlas has a free Node.js version checker. Paste the output of node --version or an exact Docker tag, and it compares the version with the Node.js advisory. It never contacts your server.
Is the $HTTP2SHELL Token Connected to the Flaw?
No. About 40 minutes after the post that spread the name, crypto promotion accounts began posting a token called $HTTP2SHELL. Our capture holds nine such posts from seven accounts, all between 23:08 and 23:27 UTC on 23 October. A Telegram channel run by a trading bot repeated the listing. None of this is verified, and nothing links the token to the flaw or its fix.
Treat any token, “scanner” or “patch tool” that carries the name as untrusted. Four GitHub projects named http2shell are older than the flaw, the oldest from 2017, and three of them describe HTTP-to-shell tools; none is about Brotli. A repository with the name is not a fix. Take fixes only from the vendor pages in the tables above. We link no token and print no contract address.
For the short fact sheet, see our CVE-2026-111497 vulnerability page. The same week brought the PHP flaws, covered in our PHP2Shell analysis.