HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch

A LinkedIn card shouting "URGENT: HTTP2Shell, RCE across the HTTP stack, PATCH NOW" landed in my feed today, so I went to the primary sources before writing anything. Short version: the bug is real, it is serious, and you should patch. But it is a bug in one library, the Brotli decoder, and whether it can hurt you depends on one question: does your software decompress Brotli data that someone else controls?

What it actually is

CVE-2026-111497 was assigned by Google, which is the CNA for Brotli. The record is titled "Out-of-Bounds Write in Google Brotli Decoder" and covers c/dec/decode.c in Brotli 1.0.3 through 1.2.0. In the record's words, the flaw "allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code" using a crafted Brotli-compressed stream. It is classed as CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value).

The Node.js advisory explains the mechanics: an invalid block switch inside the stream was reported as "need more input" instead of a format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer. The finders credited by both Google and Node.js are Khai Tran and Sylvie Mayer of OpenAI Codex Security.

"HTTP2Shell" is a nickname from security vendors, not the official name. You will also see Node2Shell, Brotli2Shell and Broccoli2Shell for the same CVE.

How bad is it?

Score: Google, as the CNA, rates it 9.2 Critical (CVSS 4.0, with "attack requirements: present"). Node.js rates it High. Red Hat rates it Important at 8.1 (CVSS 3.1) and the .NET advisory also uses 8.1 High.
Remote code execution: Demonstrated, but narrowly. Imperva ran attacker-supplied code on the official Node.js 24.22.0 Linux arm64 image, through both fetch() and Express 5 body parsing. It took several attempts, and the same input was rejected by 24.22.1. Nobody has shown reliable code execution across every platform and product.
Exploitation in the wild: None reported. It is not in the CISA KEV catalog, and CISA's enrichment on the CVE record lists exploitation as "none".

What "across the HTTP stack" really means

The bug is not in HTTP, HTTP/2 or any web server's own code. It is in a shared C library, so anything that bundles or links an affected Brotli decoder inherits it. As Jan Schaumann put it on oss-security, don't look at the Node.js advisory and think "I don't use Node.js, so nothing to worry about."

Attacker data reaches the decoder three ways: a client sends a request body with Content-Encoding: br that your app or proxy inflates, your app fetches a URL and the server answers with a Brotli body that your HTTP client decodes automatically, or your code decompresses uploaded or stored data directly. The second path is the sneaky one, because a malicious server can send Brotli even if you didn't ask for it.

Plenty of software does none of this by default. The .NET advisory, for example, says ASP.NET Core and HttpClient don't decompress Brotli unless you enable it, and Envoy says only deployments with the Brotli decompressor configured are affected.

Affected and fixed versions

Google Brotli (libbrotli): 1.0.3 through 1.2.0 affected. Fixed in 1.2.1, 1.1.1 and 1.0.10.
Node.js: 22.x, 24.x and 26.x fixed in 22.23.4, 24.22.1 and 26.12.1 (Node.js, Oct 21). End-of-life lines such as 20.x get no fix.
Bun: 1.0.21 through 1.4.3 affected, fixed in 1.4.4. Rebuild anything made with bun build --compile (Bun advisory).
Python: PyPI brotli fixed in 1.2.1 and brotlicffi in 1.2.1.0 (GHSA-9v8h-qqgm-4m35).
Envoy: fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, when the Brotli decompressor is configured (Envoy advisory).
.NET: fixed in runtime 8.0.33, 9.0.22 and 10.0.14. Self-contained and NativeAOT apps must be republished (.NET advisory).
Debian: bookworm fixed in 1.0.9-2+deb12u1 (DLA-4855-1), trixie in 1.1.0-2+deb13u1 (DSA-6582-1), sid in 1.2.0-4.1. Forky was still listed as vulnerable when I checked (Debian tracker). Debian's own nodejs packages are tracked separately from brotli and were also listed as vulnerable in bookworm and trixie.
Ubuntu: the brotli package was still "Needs evaluation" on all releases when I checked. Ubuntu notes that nodejs on 22.04 and later uses the system brotli, while 20.04's nodejs bundles its own copy and is marked vulnerable (Ubuntu CVE page).
Red Hat: track package status on the Red Hat CVE page.

Distros backport fixes, so a package can say 1.0.9 or 1.1.0 and still be patched. Trust the distro's fixed package version, not the upstream number.

How to check your systems

Node.js bundles its own copy of Brotli in the official builds, so check the runtime version and the bundled Brotli:

[root@server ~]# node --version
[root@server ~]# node -p "process.versions.brotli"

System library, by package manager:

[root@server ~]# dpkg -l | grep -i brotli
[root@server ~]# rpm -qa | grep -i brotli
[root@server ~]# apk info -v | grep -i brotli

Python packages, which HTTP clients like urllib3 pick up automatically when installed:

[root@server ~]# pip show brotli brotlicffi

Does your curl decode Brotli at all?

[root@server ~]# curl -V | grep -io brotli

Which running processes still have the system's shared decoder library loaded. This only finds processes using your distro's libbrotlidec, so official Node.js builds, Bun and static binaries, which carry their own copy, won't show up. An empty result is not an all clear:

[root@server ~]# grep -l brotlidec /proc/*/maps 2>/dev/null

Don't forget container images, CI runners and anything statically linked. Those carry their own copy.

What to do

Patch the runtime or library: Node.js, Bun, Python packages, .NET, Envoy, and your distro's brotli package.
Restart every process that loaded the decoder. Updating the package does not fix a running process.
Rebuild container images on a patched base, redeploy, and bump the pins in your lockfiles so the next build doesn't pull the old version back in.
Prioritize services that accept Content-Encoding: br bodies or fetch URLs you don't control, like webhooks, link previews and crawlers.

If you can't patch today

Inbound: reject Brotli request bodies at the reverse proxy before any decoder sees them. In nginx, for example, add this inside your server block, then test and reload:

if ($http_content_encoding ~* "(^|,)\s*br\s*(,|$)") {
    return 415;
}

[root@proxy ~]# nginx -t && systemctl reload nginx

Outbound: removing br from Accept-Encoding is not enough, because a malicious server can send Brotli anyway, and a WAF never sees responses your app fetches. Only the upgrade covers this path.
.NET: remove the br provider from request decompression and drop DecompressionMethods.Brotli from HttpClient, but only if you already enabled them, as the .NET advisory explains.
Bun: pass decompress: false to fetch for untrusted servers, per the Bun advisory.

Node.js has published no workaround. For Node.js, upgrading is the fix.

What the LinkedIn card got wrong

"RCE across the HTTP stack" overstates it. The record says "potentially execute arbitrary code". Code execution has been shown on one Node.js build and setup, not across every HTTP product, and many servers don't decode Brotli request bodies by default.
It isn't only HTTP. Anything that decompresses untrusted Brotli data is in scope, including files and archives.
"URGENT" is fair for patching, but there is no reported exploitation and no KEV listing. Patch on your normal emergency schedule, not in a panic.
"HTTP2Shell" is a nickname. Search for the CVE number when you look for vendor advisories.

My take

This one is a big deal because of where Brotli lives, not because of a clever exploit. The library sits inside runtimes, proxies, HTTP clients and archive tools, and many of them pull it in without you ever choosing it. Patch, restart, rebuild your images, and spend ten minutes finding where Brotli decoding happens in your stack. The answer will be useful long after this CVE.

Sources: CVE.org record CVE-2026-111497; Node.js October 2026 security releases; google/brotli v1.2.1 release; GitHub advisory GHSA-9v8h-qqgm-4m35; Bun GHSA-663w-cv8g-jj2p; Envoy GHSA-3wvj-j6qm-62mr; .NET advisory; Imperva research; Debian security tracker; Ubuntu CVE page; Red Hat CVE page; oss-security post; CISA KEV catalog.