Brotli2Shell (CVE-2026-111497): What organizations need to know about Node2Shell and HTTP2Shell now
October 27, 2026
Brotli2Shell at a glance
Brotli2Shell (CVE-2026-111497), also called Node2Shell or HTTP2Shell, is a critical vulnerability in Google's widely used Brotli decoder. As the responsible CVE Numbering Authority, Google rates it CVSS v4.0 9.2. It was disclosed on October 21, 2026 with the Node.js security release. Crafted Brotli-compressed data can corrupt process memory, disclose memory, crash processes and, in the worst case, enable code execution without authentication. The flaw is not in a single application but in a library embedded in Node.js, Bun, .NET, Python packages, Envoy, Istio, Java libraries, databases and media tools. Our detailed briefing with version matrix, version check, 7-point plan and exposure check: https://brotli2shell.wiz.vamisec.com/en/
What happens technically: one return value with two meanings
Brotli is a compression format that web servers and CDNs use to shrink content. The decoder works as a stream and collects bytes in an eight-byte internal buffer when it lacks input. On an impossible block switch, the function DecodeBlockTypeAndLength() returned the same value as for missing input. The decoder therefore mistook the format error for a pause, appended more bytes and wrote past the end of the buffer. According to analyses, the ninth byte overwrites the buffer's length field, which makes further writes controllable. The flaw was found by Khai Tran and Sylvie Mayer of OpenAI Codex Security. Notably, the fix has been in Brotli's public source code since February 27, 2026, but releases with the fix only came on October 21. Projects pinned to Brotli releases stayed vulnerable for almost eight months.
Which products are affected and which versions help
Google Brotli 1.0.3 through 1.2.0 is affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed product versions: Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, .NET 8.0.33, 9.0.22 and 10.0.14, the Python packages brotli 1.2.1 and brotlicffi 1.2.1.0, Envoy 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, and Brotli4j 1.24.0. Node.js 20 and older lines receive no fix; according to Microsoft, .NET Framework is not affected. For ClickHouse and libjxl, through which FFmpeg is also affected, fixes are merged but not yet released. DuckDB and Apache Arrow have no fix yet (as of October 27, 2026). The Brotli modules of nginx and Apache only compress and are not affected; the current source trees of Chrome and Firefox use Brotli revisions from March and April 2026 that contain the fix, but the first shipped browser version with the fix has not been published.
Three paths to the decoder: requests, responses and files
A system is exploitable when it decompresses Brotli data from an untrusted source. First, incoming requests with Content-Encoding: br, for example via Express 5 with body-parser 2, ASP.NET Core request decompression or Brotli filters in Envoy. Second, responses from external servers: fetch() in Node.js, HttpClient in .NET with decompression enabled and Python clients with a Brotli package installed decompress automatically. Imperva demonstrated code execution against Node.js on both paths. This puts webhooks, link previews, crawlers and AI agents with web tools that fetch user-chosen URLs at risk as well. Third, files such as JPEG XL or Parquet. A WAF only protects the inbound direction, and merely removing br from Accept-Encoding is not enough, because a malicious server can send Brotli anyway.
Status on October 27, 2026: exploits public, exploitation not confirmed
Several exploits circulate on GitHub. With them, code execution mostly succeeds only under tuned conditions, whereas a crash is easy. On October 26, ELLIO reported exploit traffic against Node.js 24.22.0 on its own sensors and rates it as the first exploitation observed in the wild. Tenable has not independently confirmed this, Rapid7 knew of no exploitation, and the flaw is not in CISA's KEV catalog. Germany's CERT-Bund lists it in advisory WID-SEC-2026-4117, rated medium. According to Akamai, 61 percent of networks run affected Node.js versions; according to Wiz, 91 percent of cloud environments have vulnerable resources.
What organizations should do now
We recommend a 7-point plan from the outside in: 1. Make visible where Brotli is decompressed, internet-facing systems first. 2. Reject requests with Content-Encoding: br at the WAF, CDN or reverse proxy and disable Brotli filters in Envoy and Istio. 3. Patch externally reachable services and services that fetch external URLs first, rebuild images and restart processes. 4. Then follow up with internal systems, data pipelines and tools. 5. From day one, request written reports from suppliers. 6. Scan code and images with the open-source scanners from JFrog and Trail of Bits, review crashes since October 21 and rotate credentials if there are indications. 7. Document everything and check reporting duties. Details and inventory commands: https://brotli2shell.wiz.vamisec.com/en/#actions
Reporting duties under NIS2, GDPR, DORA and the Cyber Resilience Act
An unexploited vulnerability alone is not reportable. If it has been exploited, reporting duties may apply under NIS2 and the German BSI Act, under the GDPR or, for financial entities, under DORA. Since September 11, 2026, manufacturers that ship Brotli or a runtime such as Node.js in their own products must report actively exploited vulnerabilities via ENISA's reporting platform under the Cyber Resilience Act. Deadlines start when you become aware of the incident.
How VamiSec supports you
As a member of the Wiz Partner Alliance, VamiSec checks at short notice whether Brotli2Shell affects you: from the outside with Wiz ASM, the Wiz Red Agent and VamiRedteam, and from the inside via read-only Wiz connectors for cloud and Kubernetes and with the JFrog and Trail of Bits scanners in your repositories. You receive a prioritized findings list and an action plan. Requests to wiz@vamisec.com or via https://brotli2shell.wiz.vamisec.com/en/#exposure-check. If you suspect a compromise, our CSIRT is available around the clock at csirt@vamisec.com.
All links and sources
Briefing and exposure check: https://brotli2shell.wiz.vamisec.com/en/ · CVE record: https://www.cve.org/CVERecord?id=CVE-2026-111497 · Node.js advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases · Brotli fix: https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b · .NET: https://github.com/dotnet/announcements/issues/494 · Imperva: https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/ · JFrog: https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/ · Wiz: https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js · CERT-Bund: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4117 · Independent product overview: https://broccoli2shell.com/
Frequently asked questions about Brotli2Shell
What is Brotli2Shell?
Brotli2Shell is a name for CVE-2026-111497, a critical vulnerability in Google's Brotli decoder rated CVSS v4.0 9.2. Other names for the same flaw are Node2Shell, HTTP2Shell and Broccoli2Shell. Crafted Brotli data can corrupt memory and, in the worst case, enable code execution.
Which versions are safe?
Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, .NET 8.0.33, 9.0.22 and 10.0.14, the Python packages brotli 1.2.1 and brotlicffi 1.2.1.0, and the fixed versions of Envoy, Istio and Brotli4j. Distributions often backport the fix without a new version number; then the package changelog counts.
Am I affected if I do not use Node.js?
Possibly, yes. The flaw sits in the Brotli decoder itself, which Bun, .NET, Python packages, Envoy, Istio, Java libraries, databases such as ClickHouse and DuckDB, Apache Arrow and FFmpeg also ship. What matters is whether a component decompresses Brotli data from an untrusted source.
Is Brotli2Shell already being exploited?
As of October 27, 2026, no exploitation of real victims has been confirmed. Public exploits exist, and ELLIO reported attack traffic on its own sensors. The flaw is not in CISA's KEV catalog. Still treat reachable systems as if they were under attack.
Does a WAF protect against Brotli2Shell?
Only partly. WAF rules from Cloudflare, Vercel or Imperva cover incoming requests; Cloudflare's rule only logs by default. No WAF sees responses from external servers that your services fetch and decompress. The patch remains necessary.
Where can I find details and support?
The detailed briefing with version matrix, version check, inventory commands, 7-point plan and FAQ is at https://brotli2shell.wiz.vamisec.com/en/. You can also request VamiSec's exposure check there.
Do you have questions about your organization's IT security?
Free Initial Consultation →