CVE-2026-111497, nicknamed Node2Shell or HTTP2Shell, is a memory-corruption flaw in Google’s Brotli decompression library, not in Node.js itself. Because Brotli is bundled into Node.js, .NET, Python packages, proxies and Linux distributions, the fix means finding every copy, not just one runtime.<\/p>\n\n\n\n
Security advisory<\/strong> \u00b7 Written in plain English, with the technical detail and the fix. Checked against the vendor and national CERT advisories at the time of writing.<\/p>\n\n\n\n Other recent advisories<\/strong><\/p>\n\n\n\n All advisories: CVE & Exploits<\/a><\/p>\n\n<\/div><\/div>\n\n\n\n Brotli is a compression format created by Google. Web servers use it to shrink pages and API responses, and browsers and HTTP clients expand them on arrival. Its decoder is copied into a long list of software, including the Node.js and Bun runtimes, Microsoft .NET, Python libraries, the Envoy and Istio proxies, several databases and some industrial products.<\/p>\n\n\n\n The flaw is in the decoder. A crafted Brotli stream can make it write past the end of a small internal buffer and corrupt nearby memory. According to the CVE record, the result can be a crash, leaked memory contents or, in some conditions, the attacker’s code running on the server. No login or user interaction is needed, only a way to get the crafted data to the decoder.<\/p>\n\n\n\n That is the important qualifier. You are at risk only if something in your stack decompresses Brotli data that an attacker can influence.<\/strong> Typical examples:<\/p>\n\n\n\n A website that only sends<\/em> Brotli-compressed pages to browsers is not, on that basis alone, exposed on the server side.<\/p>\n\n\n\n None of the nicknames comes from the vendors, which use only the CVE number. "Node2Shell" took hold after researchers at Imperva showed code execution against an official Node.js container image on 22 October 2026. Aikido’s follow-up research renamed it "HTTP2Shell" because the bug sits in a library shared by many HTTP clients and servers. The "HTTP2" does not<\/strong> mean the HTTP\/2 protocol, and whether HTTP\/2 is enabled makes no difference. Canada’s Cyber Centre calls it "Broccoli2Shell". All of these names refer to the same CVE.<\/p>\n\n\n\n The root cause is in Google Brotli 1.0.3 through 1.2.0, code that first shipped in 2018. The table covers components with official fixed versions at the time of writing.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
In plain English<\/h2>\n\n\n\n
\n\n
Content-Encoding: br<\/code> and decompresses them. Some frameworks do this automatically.<\/li>\n\n\nWhere the nicknames come from<\/h3>\n\n\n\n
\n\n\n\nWho is affected?<\/h2>\n\n\n\n