Critical HTTP2Shell (Brotli) Vulnerability Triggers Emergency Patches Across Internet Infrastructure

Data compression algorithms, among the invisible heroes of modern internet architecture, make it possible to transmit billions of HTTP requests and responses quickly every day. But a critical security vulnerability emerging in one of these foundational layers can threaten the entire global web ecosystem at once. A critical vulnerability tracked as CVE-2026-111497, discovered in Google's open-source Brotli compression library and dubbed HTTP2Shell in the security world (in its early stages Node2Shell or Broccoli2Shell), has forced tech giants and open-source communities to release emergency patches.

Rated 9.2 (Critical) on the CVSS v4.0 scale, the vulnerability targets not only web servers but also directly background API clients, microservices, cloud proxy servers and developer tools.

What Is HTTP2Shell (CVE-2026-111497) and How Does It Work?

At its core an out-of-bounds write (buffer overflow, CWE-787) vulnerability, CVE-2026-111497 stems from a critical bug in the logic that Brotli's C-based decompression (decoder) library uses to handle block type transitions.

Under normal conditions, the Brotli decoder checks the transitions between data blocks while reading a compressed data stream. But when a malformed Brotli stream specially crafted by an attacker sends an invalid transition signal between block types, the vulnerable decoder interprets it as a temporary "more input data expected" state instead of flagging it as a permanent format error.

As a result of this logic bug, the stream decoder keeps appending incoming bytes to a small 8-byte internal buffer. Because the bounds check is bypassed, the incoming data overflows the buffer and overwrites adjacent memory regions. Depending on the application's runtime architecture, this memory corruption can lead to three destructive outcomes:

• Remote Code Execution (RCE): The attacker manipulates the memory layout to run arbitrary code directly on the target server or client.
• Information Disclosure: API keys, session tokens, passwords or private data held in the memory of worker processes are leaked.
• Denial of Service (DoS): Application processes or the entire web server crash unexpectedly (crash/panic).

Why Did Node2Shell Become HTTP2Shell?

Because security researchers first discovered the vulnerability in the Node.js runtime (through the node:zlib and built-in fetch() modules), it was called Node2Shell in the early days. In-depth analysis, however, revealed that the problem was not specific to Node.js; it sat directly in all versions 1.0.3 through 1.2.0 of Google's C-based reference Brotli library.

Since the Brotli algorithm is now the standard for compressing HTML, CSS, JavaScript and JSON API traffic (Content-Encoding: br or Accept-Encoding: br), the impact suddenly spread to the entire HTTP ecosystem. Because of this widespread destructive potential, the vulnerability was renamed HTTP2Shell (and, jokingly within the community, Broccoli2Shell).

On top of that, another important detail surprised the security world: the code change that fixes the bug had actually been added to Brotli's source repository months earlier. But because no security advisory or CVE accompanied the fix at the time, downstream ecosystems such as Node.js, Python and .NET had not pulled the patch into their own libraries. With the discovery of the exploitation vector, an emergency patching race began across the entire software world.

Affected Ecosystems and Attack Surface

The most important factor that makes HTTP2Shell more dangerous than traditional server vulnerabilities is that it affects both inbound and outbound HTTP traffic.

1. Web Servers and API Gateways: Servers that automatically decompress Brotli-compressed HTTP request bodies coming from clients are directly at risk. 2. HTTP Clients and Background Services: Many modern HTTP clients (fetch, requests, httpx, urllib3) send the Accept-Encoding: br header to servers by default. If your application crawls a user-supplied URL, makes webhook calls, reads RSS feeds or generates link previews, a malicious server under the attacker's control can exploit your application instantly by returning a compressed malicious response.

The main technology stacks directly affected by the vulnerability are:

• Node.js and Bun: Directly affected through the built-in zlib and fetch components.
• Python Ecosystem: Popular libraries such as urllib3, requests, aiohttp and httpx that use the brotli and brotlicffi packages.
• Microsoft and .NET: .NET runtimes, PowerShell and Visual Studio components.
• Proxy Servers and Cloud Infrastructure: Envoy, Istio and various Go-based web frameworks (Traefik, Fiber, fasthttp).

Emergency Patches and Mitigations

Many security agencies, including the US Cybersecurity and Infrastructure Security Agency (CISA), urged developers and system administrators to update immediately against the risk of active exploitation. These are the versions you need to apply to secure your systems:

• Google Brotli Library: Upgrade to version 1.0.10, 1.1.1 or 1.2.1.
• Node.js: Update to the emergency security releases 22.23.4, 24.22.1 or 26.12.1.
• Python: Upgrade the brotli package to version 1.2.1 and the brotlicffi package to version 1.2.1.0.
• Microsoft / .NET: Apply the emergency security updates released by Microsoft to all server and developer environments.

A Critical Warning for DevOps and Security Teams

Security experts warn that you should not rely on Web Application Firewall (WAF) rules alone. A WAF may filter compressed requests coming into your server from outside, but it cannot block malicious Brotli responses returned to the outbound HTTP requests your server makes to an external API or a third-party address.

That is why it is vital to rebuild all container images (Docker/Kubernetes) with patched runtimes, scan dependency trees (package-lock.json, pnpm-lock.yaml, requirements.txt), and update and restart running application processes.