Emergency Patches Issued for Critical HTTP2Shell Brotli Vulnerability

Software maintainers and technology vendors have issued emergency security updates to address a critical memory corruption flaw in the widely used Brotli data compression library. Tracked as CVE-2026-111497, the vulnerability could allow remote attackers to corrupt memory, expose sensitive data, or achieve remote code execution (RCE) on vulnerable servers and client applications.

The flaw, variously dubbed HTTP2Shell, Node2Shell, and Broccoli2Shell, stems from a buffer overflow in Brotli’s C-based decoder library. Brotli, an open-source project originally developed by Google for lossless data compression, is embedded in numerous runtime environments, web servers, and programming language packages, extending the impact across multiple software ecosystems.

Buffer Overflow Mechanics

The vulnerability occurs when the Brotli streaming decoder processes a specially crafted compressed data stream. When an invalid block switch takes place, the decoder misinterprets the condition as a temporary request for additional input rather than a permanent format error. Consequently, the streaming decoder continuously appends incoming bytes to an internal eight-byte buffer, writing past buffer limits and corrupting adjacent memory space.

Attackers can exploit this flaw by forcing an application to decompress malicious payload streams. Risk vectors include serving a malicious compressed response to an application fetching a URL or sending a crafted compressed request directly to a web server.

Broad Impact Across Software Ecosystems

Because many applications bundle their own copies of the Brotli decoder rather than relying on host operating system libraries, the flaw affects multiple development frameworks and runtime environments. Affected software includes:

• Node.js: Embedded Brotli deployments across several release lines.
• Python Libraries: HTTP networking packages including urllib3, requests, httpx, and aiohttp when configured with vulnerable Brotli decoder backends.
• Microsoft .NET: Microsoft released an out-of-band security update for .NET after discovering that successful exploitation could enable privilege escalation.

The vulnerability affects upstream Google Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.

Patches and Remediation Guidance

Upstream code patches have been released across affected projects. Administrators and developers are urged to update to fixed versions, including Google Brotli versions 1.0.10, 1.1.1, and 1.2.1; Node.js versions 22.23.4, 24.22.1, and 26.12.1; and Python Brotli package version 1.2.1.

While public proof-of-concept exploit code has been published, security researchers have not reported active exploitation in the wild. System administrators should note that updating system-level Brotli libraries will not remediate applications, such as Node.js, that rely on bundled instances. Following updates, active application processes must be restarted and container images rebuilt to ensure the fix takes effect.