Developers and major tech companies have released emergency security patches to address an extremely critical vulnerability known as HTTP2Shell (tracked as CVE-2026-111497 and also known as Node2Shell and Broccoli2Shell), which affects the C-based Brotli decompression library embedded in Node.js and several other programming platforms.
The vulnerability affects Brotli versions 1.0.3 through 1.0.9, as well as versions 1.1.0 and 1.2.0. The issue was reported under multiple names because it was first discovered in the Node.js environment before it became clear that the same flaw in the Brotli decompressor affects software across various and different tech environments.
Scope of Impact and Affected Systems
Although the name HTTP2Shell reflects its potential impact on HTTP protocol clients and servers, the vulnerability is not restricted to HTTP/2 alone, but extends to any applications relying on Brotli data decompression controlled by attackers. Potentially affected applications include:
- The popular Node.js runtime environment.
- Python HTTP libraries such as urllib3, requests, httpx, and aiohttp when configured to work with a compromised Brotli decompressor.
- Emergency security updates pushed by Microsoft to address the vulnerability in the .NET platform, given that its exploitation allows for privilege escalation on compromised systems.
Exploitation Mechanism and Technical Impacts
The vulnerability consists of a buffer overflow flaw, where a specially crafted Brotli data stream triggers invalid block-switching operations that the decompressor treats as valid and misinterprets as a request for more input. By continuously appending input bytes into an internal eight-byte buffer, the write operation exceeds its allowed limits and corrupts adjacent memory.
Technical reports issued by the cybersecurity firm Imperva explained that successful exploitation of this vulnerability could lead to operational crashes, exposure of sensitive memory contents, and ultimately Remote Code Execution (RCE).
What Changes Practically and How to Fix It?
Although there are no current reports confirming the exploitation of the vulnerability in wild cyberattacks, the availability of proof-of-concept (PoC) exploit code requires swift action by system administrators and developers.
- Immediate Updates: Updated versions are available to fix the flaw in Google Brotli (1.0.10, 1.1.1, and 1.2.1), Node.js (versions 22.23.4, 24.22.1, and 26.12.1), in addition to the affected Python libraries.
- Additional Steps: After installing the updates, administrators must restart affected operations, rebuild container images, and redeploy them.
- Temporary Workarounds: If immediate updating is not possible, it is recommended to completely remove Brotli support from Python applications and block incoming Brotli requests at the proxy or firewall level.