HTTP2Shell: One Brotli Flaw, Many Stacks and Their Fixes

HTTP2Shell is a nickname for CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder. It is not a second flaw, and the bug is not in the HTTP/2 protocol. The CVE record lists Brotli 1.0.3 through 1.2.0 as affected and names 1.0.10, 1.1.1 and 1.2.1 as the fixed releases.

Many programs carry their own copy of that decoder, so the fix reaches each one separately. This post tracks published fixes and vendor status, including products still being checked. Rows reflect those pages on 24 October 2026 at 18:40 UTC, with later checks on 25, 28 and 29 October. Node.js details are in our Node2Shell analysis.

Last updated: 11 November 2026 (Debian forky, Red Hat Node.js, Ubuntu 16.04 to 20.04 and SUSE python-Brotli rows corrected; NVD and KEV status added). Earlier checks covered AWS, Git for Windows, Cisco, Ubuntu, Firefox and Thunderbird. We update this post when vendors publish fixes or product assessments.

Update 11 November: NVD lists the record as analyzed, with a CVSS 3.1 score of 9.8 from NIST next to Google’s 9.2 on CVSS 4.0. The KEV due date of 10 November has passed.

Is HTTP2Shell a New Vulnerability?

No. Node2Shell came first because Node.js shipped the first fix on 21 October. In our X capture, the first post using that name is from 21 October at 17:08 UTC.

“HTTP2Shell” spread after a security vendor’s post on X at 22:26 UTC on 23 October said the vulnerability reached beyond Node.js. Bun’s own post at 00:15 UTC on 24 October used the new name for its advisory.

Open the post on X (@bunjavascript, Bun, 24 October 2026, 00:15 UTC). Our capture holds 229 posts that use the name between 23 October at 16:54 UTC and 24 October at 18:34 UTC. The capture is partial, so read it as a floor.

The CVE record and the Node.js advisory do not use the name. GitHub’s advisory title still says “Node2Shell”. The name is also misleading about where the bug sits.

The Node.js advisory explains it: an invalid block switch was reported as a temporary need for more input instead of a permanent format error. The streaming decoder then kept appending input bytes to an eight-byte internal buffer.

So any code that decodes attacker-supplied Brotli data can reach the bug. Red Hat’s page gives two examples: HTTP content negotiated with Content-Encoding: br, and APIs such as the Node.js zlib module and fetch().

A third name, Broccoli2Shell, has been used on X since 24 October 2026. A Wiz Research blog post of 25 October 2026 uses it and lists Node2Shell and HTTP2Shell as other names for the same CVE. Wiz says its data show that 91% of cloud environments have resources vulnerable to CVE-2026-111497 and that 82% have publicly exposed Node.js instances.

Japan’s JPCERT/CC and IPA published advisory JVNVU#97400824 (in Japanese) on 26 October 2026. It lists HTTP2Shell and Node2Shell as names for CVE-2026-111497. The affected versions are Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1. It says several products that bundle the library are confirmed affected and advises updating.

Which Runtimes and Libraries Carry the Decoder?

Each row links to the vendor’s own page. A product is listed only where a page says it is affected or fixed.

Two projects with their own decoder copy had no fix on 26 October. DuckDB’s issue 27660 reports that its vendored Brotli lacks the fix. Its pull request 27791, which ports the fix into the vendored 1.1.0 copy, is open. Apache Arrow’s issue 55166 reports bundled Brotli 1.0.9, and its pull request 55167, approved by a project member, is not yet merged.

Microsoft’s Security Update Guide entry for CVE-2026-111497, published on 25 October 2026, describes an out-of-bounds write in .NET that lets an unauthorized attacker elevate privileges over a network. It scores the flaw 8.1 on CVSS 3.1 with high attack complexity and rates it Critical for .NET. The entry marks the flaw as publicly disclosed and not exploited, and assesses exploitability as “Exploitation More Likely”.

How to read this table. The fixed version belongs to the product, not to the library inside it. Updating a system package does not fix a program that carries its own static copy, such as a Bun executable. Vulnerability intelligence software that follows vendor advisories and exploitation reports can flag when a product in this table ships its fix.

The ngx_brotli README describes no step that decodes data from users. That is our reading, not a vendor statement, and we have not tested it. Rebuild with the new submodule when you next ship.

OpenAI’s Patch the Planet page lists the same fixed releases for Node.js, Bun, Envoy, Istio and Brotli, reviewed on 23 October 2026. It advises checking the running binary or image against the vendor’s fixed release. It also says to restart or redeploy every service, worker, scheduled job and replica that uses the old build.

Until you can patch, the page advises disabling Brotli decoding of untrusted data and keeping gzip and deflate. For Envoy and Istio, it says to disable the Brotli decompressor filter for both requests and responses. Encoded data then passes onward, so protect any vulnerable downstream decoder. It says request-size limits and WAF rules alone do not cover every decoding path.

OpenAI’s Patch the Planet page also tells teams to look beyond servers. Electron-based desktop tools can carry several Brotli copies, so check both Chromium and Node.js. Check the decoder loaded by curl and libcurl, by Python and Java bindings and by other native libraries. Font decoders and data-file readers that use Brotli are in scope too.

A public lab of 27 October reports that a WordPress XML-RPC pingback can make libcurl fetch a Brotli response from an attacker’s server and decode it inside the PHP worker. In the author’s tests on PHP 8.3.36, a 23 MB stream crashed the worker and an 86-byte stream held it at full CPU. The author reports no code execution. We ran nothing and link nothing.

The table leaves out browsers and Electron-based desktop apps. The table lists only products with a vendor advisory, a fixed release or a published fix commit.

On 28 October Red Hat’s CVE page lists Firefox and Thunderbird 140.10.0 packages as fixed, in errata dated between 27 April and 20 May 2026. Browsers stay out of the table, which lists only fixes published by each product’s own vendor.

What Do the Azure and Cloudflare WAF Rules Cover?

Microsoft’s Azure WAF guidance of 23 October 2026 says rule 920450 in DRS 2.2 blocks the crafted requests it analysed by default, on Application Gateway and Front Door Premium. DRS 2.1 and CRS 3.2 or earlier need the upgrade, or a custom rule that blocks Content-Encoding: br. Microsoft advises starting that rule in log-only mode, because it can block legitimate Brotli request bodies.

Microsoft notes that Azure WAF inspects only inbound requests, so apps that fetch and decompress Brotli responses from external servers must be patched. It says the proof-of-concept payloads analysed so far are about 23 MB each. It adds that attackers may be able to craft smaller ones, so size limits are an extra layer, not a mitigation on their own. It lists Node.js and Python applications that bundle the vulnerable decoder among those affected.

Cloudflare’s emergency WAF release of 25 October 2026 announces two rules for CVE-2026-111497 in the Cloudflare Managed Ruleset. Both are set to be enabled by default, but their action is Log, so with the defaults they record matching requests and block nothing. Cloudflare says customers can review matches in analytics and set a blocking action if they want one.

The Brotli rule, “Brotli – Request Content-Encoding”, matches requests that declare Content-Encoding: br, including legitimate clients that send Brotli request bodies. It does not match Accept-Encoding: br or change Cloudflare’s Brotli response compression. The Next.js rule, “Next.js – Image Optimizer Path”, matches requests to /_next/image. Cloudflare warns that switching it to Block may stop optimized images from loading.

Cloudflare also warns that an existing ruleset-level override set to Block takes effect as soon as the rules deploy. Matching requests, including legitimate ones, may then be blocked. Check your overrides first. To test without blocking, set rule-specific overrides to Log and review the matches before you choose Block.

With the defaults, these rules only log. By our reading, neither inspects Brotli data that your own code fetches from other servers, as with Azure WAF. Patching stays the fix.

What Does Mitel Report for Its Products?

Mitel’s MISA-2026-0010 advisory, revision 1.0 of 28 October, separates affected products from those still under review. Its statements cover supported versions only. Products that have reached end of support are outside that assessment.

For OpenScape Endpoint Management, Mitel rates the product-specific risk low when it is deployed according to Mitel’s recommended guidelines. This qualified assessment does not turn Planned Update into a released fix. It also does not replace the Brotli library’s severity or apply to other products.

MISA-2026-0009 says OpenScape Endpoint Management V1R2.5.1 corrects separate Node-RED issues. For Brotli, MISA-2026-0010 still lists that version as affected and names only a planned update.

Mitel points to KB000129034 for product guidance. Its public advisory gives no universal appliance upgrade or workaround. Keep the affected product’s status open until Mitel names a fix or changes the assessment.

Where Do the Linux Distributions Stand?

Distribution pages change by the day, so read the one for your release on the day you patch. This table began with checks on 24 October. Later checks covered Alpine, Debian and Ubuntu on 25 October, Red Hat and Ubuntu on 28 October, and the SUSE image rows below on 29 October. On 11 November we read the Debian, Alpine and Red Hat rows and the SUSE python-Brotli rows again, and Ubuntu’s status through OSV.

Red Hat rates the vulnerability Important, 8.1 on CVSS 3.1. Besides the three brotli errata above, it lists its Hardened Images as fixed, with advisory RHSA-2026:87420 of 21 October.

SUSE also lists Node.js packages in QA. Its QA list names nodejs22 >= 22.23.4-150700.3.21.1 and nodejs24 >= 24.22.1-150700.15.21.1 for SUSE Linux Enterprise Server 15 SP7. For Server 15 SP6-LTSS, the QA build is nodejs22 >= 22.23.4-150600.13.27.1.

These QA entries do not confirm that updates have shipped. Check the release status for your own product and support channel.

Which Red Hat Advisories (RHSA) Carry the Brotli Fix?

Red Hat’s CVE page lists three brotli errata for Red Hat Enterprise Linux 8, 9 and 10, all dated 26 October:

• RHSA-2026:90501 with brotli 1.0.6-5.el8_10.
• RHSA-2026:90495 with brotli 1.0.9-10.el9_8.1.
• RHSA-2026:90449 with brotli 1.1.0-8.el10_2.1.

The Extended Update Support and SAP channels have their own errata, dated 27 October. They are in the table above.

Which SUSE Images Now Have Listed Fixes?

Our 29 October check of the SUSE CVE page found four more rows with fixed builds. Match the row to the image you run. These rows do not mean that all SUSE products have a fix.

The Manager package version is not an image build number. Each image name below starts with suse-multi-linux-manager-5.1-x86_64-. Add the listed ending to that prefix when you match a build in your inventory.

SUSE’s CVE page, read on 11 November, lists python-Brotli as Released on SUSE Linux Enterprise Server 16.0 and its SAP applications variant. It still lists python-Brotli on openSUSE Leap 16.0 as Affected. Earlier checks showed In progress and then Affected for the Server 16.0 rows.

Check the exact package or image row before you close a patch task. Use the listed fixed build or a later fixed build in that same product line. Keep separate tasks open for rows still marked Affected or In progress.

Debian’s tracker notes that its nodejs package uses the system Brotli library and rates the nodejs entry unimportant. On Debian, the brotli package update is the one that fixes Node.js.

How Real Is the Risk of Remote Code Execution?

The vendors call it remote code execution. Public proof of concept code tells a more mixed story. We read repository descriptions and README files only, ran nothing and link none.

CISA lists the flaw as “Google Brotli Unchecked Return Value Vulnerability” and notes that it sits in an open-source component other products can embed. Its required action is to apply vendor mitigations, or stop using the product if none exist.

The due date of 10 November binds US federal civilian agencies under BOD 26-04. CISA says organizations should use the catalog as an input to their vulnerability management priorities. The listing does not say who is exploiting the flaw, against which software or how. It does not settle the question of code execution discussed next.

Two READMEs report remote code execution against lab apps on one exact build, the official Node.js 24.22.0 for Linux x86-64. One covers an Express 5.3.0 profile, recorded on 22 and 23 October. The other repository was created on 24 October and had 85 stars on 28 October. Both authors say the fixed 24.22.1 rejects the request.

Both call the result probabilistic. It needs addresses taken from that exact binary, and a miss crashes the worker. Other READMEs report crashes only, and two argue that code execution cannot be reached. These are authors’ claims, not findings by Node.js or Google.

A crash alone can take down a service that decodes Brotli from users. The patch order below does not depend on who is right about code execution.

What Should You Patch First?

In our view, CISA’s listing of 27 October makes the first group below urgent. The order itself does not change.

1. Servers that decode Brotli request bodies from the internet. That means Express 5 apps on Node.js 22, 24 or 26, and Envoy with the decompressor configured. An attacker only has to send a request. Red Hat advises not accepting or auto-decoding Content-Encoding: br from untrusted sources where the application allows it.
2. Clients that fetch from servers you do not control. Bun’s fetch sends br in its default Accept-Encoding header, and Bun says a malicious server can then supply the data. Crawlers, webhook senders and integrations fall in this group. In Bun, decompress: false turns decoding off for one request.
3. Build servers and developer machines that run Node.js, Bun or Python and fetch third-party content.
4. Unsupported runtimes. Node.js 20 and older have no published fix. Plan a move to a supported line and treat them as exposed until then.
5. Linux hosts. Apply the package marked fixed in the table above. Where your distribution lists none, read its page again each day.

Free Node.js Version CheckNode.js is one of the stacks above. Paste an official Node.js version into Atlas and it says whether that version is vulnerable to CVE-2026-111497. It compares the number with the Node.js advisory and never contacts your server. It covers Node.js only.Check Your Node.js Version Free →

How Do You Find Brotli in Your Own Estate?

The decoder hides in three places: a system package, a language package, and a private copy inside a product or image. Check all three.

A compiled binary may not show that name, so a miss there proves nothing. For the code paths, split the search in two.

• Client side: code that fetches from other servers and accepts br in Accept-Encoding. In Node.js this includes fetch(). Our Node.js analysis covers it in more detail.
• Server side: body parsers that decode Content-Encoding: br requests, and gateways with a Brotli decompressor. Express 5 does this by default for JSON bodies.

For Node.js versions, Brandefense Atlas has a free Node.js version checker. Paste the output of node --version or an exact Docker tag, and it compares the version with the Node.js advisory. It never contacts your server.

Is the $HTTP2SHELL Token Connected to the Flaw?

No. About 40 minutes after the post that spread the name, crypto promotion accounts began posting a token called $HTTP2SHELL. Our capture holds nine such posts from seven accounts, all between 23:08 and 23:27 UTC on 23 October.

A Telegram channel run by a trading bot repeated the listing. None of this is verified, and nothing links the token to the flaw or its fix.

Treat any token, “scanner” or “patch tool” that carries the name as untrusted. Four GitHub projects named http2shell are older than the flaw, the oldest from 2017, and three of them describe HTTP-to-shell tools; none is about Brotli. A repository with the name is not a fix.

Take fixes only from the vendor pages in the tables above. We link no token and print no contract address.

For the short fact sheet, see our CVE-2026-111497 vulnerability page. The same week brought the PHP flaws, covered in our PHP2Shell analysis. For the other JavaScript platform fixes of that window, read our Next.js and Node.js security updates guide.