A critical Brotli compression flaw, dubbed HTTP2Shell, could enable memory corruption and remote code execution
The vulnerability affects widely used software including Node. js, Python packages, and . NET applications
Vendors released patches, and administrators are urged to update immediately despite no confirmed in-the-wild exploitation
Multiple tech companies and projects have recently pushed patches for a vulnerability called “HTTP2Shell” which could enable remote code execution (RCE) attacks, similar to the recent “PHP2Shell” vulnerabilities. HTTP2Shell was found in Brotli, a Google-built open source data compression algorithm that reduces file sizes without losing information, thus achieving faster transmission times while using less bandwidth. It is a popular algorithm used on the web to compress HTTP responses such as HTML, CSS, and JavaScript, and is supported by most web browsers, servers, and software libraries. Fixes and patches
The bug itself is described as an out-of-bounds write flaw, and is also dubbed Node2Shell, and Broccoli2Shell. It is tracked as CVE-2026-111497, and was given a severity score of 9. 2/10 (critical). According to the National Vulnerability Database, the bug causes a buffer overflow which could lead to memory disclosure, denial of service and, in some cases, even remote code execution. Brotli can be found in all sorts of software, all of which is now at risk. That includes Node. js, brotlicffi, HTTP clients such as Requests, urllib3, httpx and aiohttp, but also other apps that use Brotli decoders such as Bun and Envoy deployments. Google fixed the bug on October 21 2026, by releasing Brotli versions 1. 0. 10, 1. 1. 1, and 1. 2. 1. However, there are other software that either bundle or use vulnerable Brotli versions, so updating Google’s library alone may not protect every application. Over the last weekend, Microsoft released an emergency update to sort the bug in . NET, saying successful exploitation could lead to privilege escalation. Since it also bundles the Brodli decoder, Node…