HTTP2Shell Brotli Flaw Prompts Patches Across Major Software

Technology companies and software projects have released patches for HTTP2Shell, a critical vulnerability in Brotli, Google’s open-source compression algorithm. The flaw is tracked as CVE-2026-111497 and has a severity score of 9.2 out of 10.

Also called Node2Shell and Broccoli2Shell, the bug is an out-of-bounds write that can cause a buffer overflow. The National Vulnerability Database says it could expose memory, cause denial of service or, in some cases, enable remote code execution. Brotli is used to compress web responses, and affected software includes Node.js, Bun, Envoy deployments, and Python packages such as brotlicffi. HTTP clients including Requests, urllib3, httpx and aiohttp may also be affected.

Google released fixes in Brotli versions 1.0.10, 1.1.1 and 1.2.1 on October 21, 2026. Node.js also issued a patch that day. Microsoft released an emergency .NET update over the weekend; it said successful exploitation could lead to privilege escalation. PyPI packages containing fixes became available on October 23, according to BleepingComputer. Updating Brotli alone may not protect applications that bundle vulnerable versions.

The Broccoli2Shell.com site says a public proof of concept appeared on GitHub on October 22, 2026, but reports of malicious exploitation in the wild had not yet emerged. It said the proof of concept reportedly achieves code execution only on a deliberately weakened build; on standard builds, it causes a crash and limited memory read.