From Node2Shell to HTTP2Shell: The Expanding Reach of CVE-2026-111497

TL;DR: A critical vulnerability in Google's Brotli compression library, initially identified as "Node2Shell," has been renamed HTTP2Shell as its impact is found to span numerous HTTP libraries and applications across multiple programming languages.

---

🚨 The Situation Overview

Originally disclosed by Node.js on October 21st, CVE-2026-111497 describes a flaw where a process decompressing attacker-controlled Brotli data can suffer from memory leaks or be forced to execute arbitrary code.

The "blast radius" expanded rapidly:

• Wednesday: Node.js disclosure.
• Thursday: Python packages confirmed as vulnerable.
• Friday: Discovery that other major languages and HTTP-based services are affected, with some patches still pending.

🛠 Technical Deep Dive

What is Brotli?

Brotli is a lossless data compression algorithm developed by Google. It is primarily utilized to reduce the size of web content (such as HTML, CSS, and JavaScript) to speed up internet transmission and storage.

The Vulnerability Mechanism

The flaw is an out-of-bounds write occurring in the Google Brotli decoder (versions 1.0.3 through 1.2.0).

Mathematically, the vulnerability can be viewed as a failure in boundary validation: $\text{Input Bytes} > \text{Buffer Capacity} \implies \text{Memory Corruption}$

Essentially, a bug causes the decoder to continue accepting bytes beyond the intended limit. These excess bytes overflow a small working buffer, allowing an unauthenticated remote attacker to:

1. Corrupt system memory.
2. Leak sensitive information.
3. Crash the application (DoS).
4. Execute arbitrary code (RCE).

Risk Assessment

The vulnerability carries a CVSS v4.0 score of 9.2 (Critical).

As noted by OpenAI, who discovered the issue in February, the attack is bi-directional. A malicious client can compromise a server, and a malicious server can compromise a client that accepts compressed responses.

⏳ Timeline and Disclosure

Interestingly, the root cause was fixed in the Brotli source code back in February. However, it was not categorized as a security vulnerability at the time, meaning no security-specific release was shipped until recently. Consequently, every project that bundles Brotli must now issue its own independent update.

🛡️ Remediation Guide

How to Patch

If you are using any environment with Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x, you are exposed. This is especially true for Python HTTP clients like requests, httpx, and aiohttp, which load these packages automatically.

Update Path by Platform:

• Node.js: Upgrade to 22.23.4, 24.22.1, 26.12.1, or newer.
• Python: Update Brotli to $\ge 1.2.1$ and brotlicffi to $\ge 1.2.1.0$.
• Envoy: Upgrade to 1.40.0, 1.39.3, 1.38.6, or 1.37.8.
• curl / libcurl: Ensure the Brotli dependency is updated to 1.2.1.
• OS Packages: Apply the latest vendor security updates (note: versions may be backported).

Summary of Fixed Releases (as of Oct 23, 2026)

Remediation Checklist

• Identify if Brotli is a dependency in your libraries.
• Update runtime/library versions.
• Update dependency lock files.
• Rebuild container images.
• Redeploy and restart all affected services.

⚠️ Temporary Workarounds

If an immediate upgrade is impossible, you can reduce your attack surface:

For Python Applications: If Brotli support is optional, remove the libraries entirely:

pip uninstall brotli brotlicffi

Note: Ensure you remove dependency extras like httpx[brotli] to prevent them from being reinstalled during the next build.

---

Final Note: Be aware that as of October 23, some advisory databases (like Dependabot or Safety) may not yet map this CVE to specific PyPI packages. Do not rely solely on automated scanners; manually verify your versions.