Critical Brotli Decoder Flaw Triggers Emergency Security Updates Across Ecosystems

Emergency security updates are being deployed across major software ecosystems following the disclosure of a critical buffer overflow vulnerability in the C decoder library for Brotli, the open-source data compression format maintained by Google.

Tracked as CVE-2026-111497 and dubbed ‘HTTP2Shell’, also known as ‘Node2Shell’ and ‘Broccoli2Shell’, the flaw enables remote attackers to corrupt system memory, expose process data, or potentially achieve remote code execution (RCE) by processing specially crafted compressed data streams.

Memory Corruption in Brotli Streaming Decoder

The security flaw stems from an error-handling bug inside the Brotli streaming decoder. When encountering an invalid block switch, the decoder misinterprets the condition as a temporary request for additional input rather than a permanent format error.

According to technical documentation published by the Node.js project, this logic defect causes the streaming decoder to continuously append incoming bytes to an internal eight-byte buffer. The resulting buffer overflow overwrites adjacent memory addresses, creating opportunities for process crashes and code execution.

Cybersecurity firm Imperva confirmed that successful exploitation of the CVE-2026-111497 buffer overflow can lead to remote code execution in vulnerable deployments.

Widespread Ecosystem Impact

Although initially identified within Node.js, the underlying vulnerability exists in the core Brotli C library maintained by Google, creating risks across numerous programming environments and tools that handle compressed web traffic or file transfers.

Impacted software includes Node.js runtime builds, Microsoft .NET framework environments, and popular Python HTTP clients such as urllib3, requests, httpx, and aiohttp when configured with vulnerable Brotli decoder bindings. Microsoft issued an emergency security patch over the weekend to mitigate privilege escalation risks on affected .NET systems.

Upstream fixes were first committed to Google’s Brotli codebase in February, with stable updates released across maintainer channels between 21 October and 23 October. Updated software versions containing the security fix include:

• Google Brotli: Versions 1.0.10, 1.1.1, and 1.2.1
• Node.js: Versions 22.23.4, 24.22.1, and 26.12.1
• Python Brotli: Version 1.2.1
• Python brotlicffi: Version 1.2.1.0

Remediation and Operational Guidance

Proof-of-concept (PoC) exploit code for the vulnerability has been published publicly, though security researchers report no evidence of active malicious exploitation in the wild at this time.

System administrators and developers are urged to prioritize applying available updates immediately. Because many application frameworks bundle their own copy of the Brotli library, updating system-level libraries alone may not remediate the vulnerability. After installing patched library builds, administrators must restart running application processes and rebuild affected container images.

If immediate updates cannot be deployed, security guidance recommends disabling Brotli support in Python applications or filtering incoming Brotli-compressed requests at the reverse proxy or web application firewall level.