By The Brotli decoder bundled into Node.js, Python, Bun, .NET, Envoy, and Istio has a critical out-of-bounds write that enables remote code execution. CVE-2026-111497 — variously called HTTP2Shell, Node2Shell, and Broccoli2Shell — scores 9.2 on CVSS v4.0. CISA confirmed active exploitation on October 27 and handed federal agencies a November 10 deadline. If you run any of these runtimes in production, skip straight to the fix section.
What Is HTTP2Shell?
The bug lives in Google’s Brotli C library (libbrotli), not in Node.js or Python themselves. That distinction matters: libbrotli is statically compiled into Node.js, Bun, and several other runtimes. You cannot patch the system library and call it done — only a runtime upgrade closes the hole.
The root cause is in DecodeBlockTypeAndLength(), which returned a boolean that conflated two different failure states: “format error” and “needs more input.” A crafted Brotli stream that declares one block type then triggers a block switch causes the decoder to continue with corrupted state — stale Huffman tree pointers and context maps — and execute an out-of-bounds write on the ring buffer via memmove16(). Memory disclosure or arbitrary code execution follows. A public proof-of-concept is already circulating on GitHub.
Who Is Affected
The blast radius is wide. Check your runtime against this table:
| Runtime | Vulnerable | Fixed version |
|---|---|---|
| Node.js 22.x (LTS) | below 22.23.4 | 22.23.4 |
| Node.js 24.x (LTS) | below 24.22.1 | 24.22.1 |
| Node.js 26.x | below 26.12.1 | 26.12.1 |
| Node.js 20.x and older | all versions | no fix (EOL) |
| Bun | below 1.4.4 | 1.4.4 |
| Python Brotli (PyPI) | below 1.2.1 | 1.2.1 |
| brotlicffi (PyPI) | below 1.2.1.0 | 1.2.1.0 |
| .NET 8.x | below 8.0.33 | 8.0.33 |
| .NET 9.x | below 9.0.22 | 9.0.22 |
| .NET 10.x | below 10.0.14 | 10.0.14 |
| Envoy | Brotli decompressor enabled | 1.40.0 / 1.39.3 / 1.38.6 |
| Istio | Brotli decompressor enabled | 1.31.2 / 1.30.6 / 1.29.9 |
Node.js 20 and every older line are end of life and will not receive a patch. If your team has been treating LTS as “safe to stay indefinitely,” this is the correction.
The Attack Vector You Are Probably Overlooking
Most developers assume the risk is limited to accepting Brotli-compressed uploads. That is the narrow threat model. The broader one: any Node.js application that fetches data from an external API — and that API responds with Content-Encoding: br — is exposed if an attacker can influence which API you call. Compromised upstream dependencies, server-side request forgery, or open redirect chains can all route attacker-controlled Brotli data into your decoder without your server accepting a direct upload.
The first documented exploitation in the wild was October 26, 2026. Imperva demonstrated full code execution against an unmodified Node.js 24.22.0 container — no debugger, no custom build — using only crafted Brotli data delivered over HTTP. The full RCE analysis from Ellio Tech walks through the exploitation chain.
Fix It Now
Upgrade commands for each runtime:
# Node.js — upgrade to the patched version for your line
nvm install 24.22.1 && nvm use 24.22.1
# or via package manager (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install nodejs
# Bun
bun upgrade # targets 1.4.4+
# Python
pip install --upgrade "brotli>=1.2.1" "brotlicffi>=1.2.1.0"
# .NET — confirm version
dotnet --list-sdks # need 8.0.33+, 9.0.22+, or 10.0.14+For Docker-based deployments, rebuild images from updated base images. FROM node:24.22.1 is the minimum for Node 24. Audit your CI pipeline for any pinned base image versions — they are the most common source of missed patches in containerized environments.
Verify Your Exposure
Assetnote released node2shell-scanner, a high-fidelity HTTP detection tool. It sends four control probes followed by a 23MB crafted Brotli stream and only flags a target as vulnerable when response patterns confirm it. For teams under change-control restrictions, detection-only alternatives — which never send the exploit payload — are available from RedSide Security on GitHub.
Scan exposed HTTP endpoints before and after patching to confirm remediation. Given that CISA has confirmed active exploitation, treat unscanned endpoints as assumed-vulnerable until proven otherwise.
The Bottom Line
HTTP2Shell is one bug in one library that shipped inside a dozen runtimes. The November 10 federal deadline is a floor, not a target — exploitation is live now. Upgrade Node.js, Bun, Python’s Brotli bindings, and .NET today. Node.js 20 or older means migration to a supported line; no patch is coming for EOL versions.
