HTTP2Shell: CVE-2026-111497 is a Brotli flaw, and it is bigger than Node.js

The CVE record for CVE-2026-111497 describes a Brotli problem, not a Node.js one: “A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.”

That is broader than the way this desk first reported it. On 22 October the desk covered Node’s security releases under the headline Node.js patches a Brotli RCE and two TLS hostname bypasses, following the project’s own announcement wording. Node was patching a flaw in the library it bundles, and every other project bundling Brotli had to do the same. The CVE belongs to the Brotli library; Node is one consumer among many.

What the record actually carries

The fix line is explicit: “Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.”

On scoring, one correction to the circulating summaries. The record carries a CVSS v4.0 base score of 9.2, critical, but as a secondary metric supplied by Google’s CNA rather than an NVD judgement. NVD’s status for the CVE is “Awaiting Analysis” and it publishes no primary score of its own. The record also includes a CISA Coordinator SSVC assessment dated 23 October: exploitation “none”, automatable “no”, technical impact “total”. Those are different instruments and they do not contradict each other; one describes severity, the other what is known about use.

The scope is every decoder

The GitHub advisory is blunt about reach. GHSA-9v8h-qqgm-4m35 is rated critical, and its affected ranges are brotli >= 1.0.3, < 1.2.1 with 1.2.1 patched, and brotlicffi >= 1.0.3, < 1.2.1.0 with 1.2.1.0 patched. The advisory still files the flaw under the earlier name Node2Shell.

Distributions are shipping their own fixes. Debian’s LTS advisory DLA-4855-1 covers brotli for bookworm, fixed in 1.0.9-2+deb12u1, and recommends upgrading the brotli packages.

Aikido, the security vendor tracking this under the name HTTP2Shell, lists patches as available for “libbrotli, Python, C++, NodeJS, bun, Envoy and more coming”. Treat that as a snapshot taken while the work was still moving, not as a finished matrix. The same write-up notes that “Apache and Nginx do not decode brotli by default”, which is the difference between a web server that fronts a vulnerable app and one that is itself a decoder.

The condition that decides your exposure is simple: something in the path has to decompress Brotli. Reverse proxies that decode compressed request bodies, application servers with compression middleware, language packages pulled in automatically, and bundled copies inside base images all qualify. A service that never touches Brotli is not exposed by this, whatever it wraps.

Both directions, and a February discovery

Aikido reports the flaw “works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses”. Servers get patched first because they face the internet, but clients matter here too.

The same write-up credits OpenAI with finding it in February and reporting it as unauthenticated remote code execution. In that account “The root cause was fixed in the Brotli source code in February, but it wasn’t recognized as a security issue at the time and no release shipped with the fix until now. That means every project that bundles Brotli has to ship its own update.” That “every project” is why a single library fix arrives as release notes across the ecosystem.

What to do

Find Brotli before you patch it: base images, language packages, bundled copies in proxies and apps, anything that decodes request bodies or responses.

Then update. Brotli itself to 1.2.1, or the 1.0.10 and 1.1.1 lines the CVE names. Python brotli to 1.2.1 and brotlicffi to 1.2.1.0, and, as Aikido puts it, “rebuild any container images that bundle them” rather than only bumping a requirement. On Debian, the version in DLA-4855-1.

Where a component still has no patch, Aikido’s advice is to disable decoding: “If there is no patch available for a library or application that may be affected, we recommend disabling Brotli decoding until patches become available.” Their write-up adds a caveat worth repeating, because the obvious reading of that advice is wrong: a client that merely stops advertising Brotli can still be sent a Brotli response, and some HTTP libraries pick the decoder from the response header instead. Turning it off has to mean the client refuses to decompress, not that it asks politely for something else.

One last practical note from the same source: as of 23 October, “advisory databases don’t map the CVE to either PyPI package, so pip-audit, Dependabot, and Safety won’t flag vulnerable versions yet”. The advisory exists now, but scanners lag. An empty audit output is not evidence that the package is fixed.

Sources: the NVD record for CVE-2026-111497, GHSA-9v8h-qqgm-4m35, Debian LTS advisory DLA-4855-1, and Aikido’s HTTP2Shell write-up.