A critical flaw in Brotli, the open-source compression library maintained by Google and built into Node.js, can let attackers corrupt memory and run their own code on affected systems. The vulnerability is tracked as CVE-2026-111497 and has picked up several nicknames, including HTTP2Shell, Node2Shell and Broccoli2Shell, because researchers first found it in Node.js before realizing the same decoder bug reaches other ecosystems.
Emergency fixes are already rolling out. Microsoft pushed an emergency security update for .NET on Sunday, warning that successful exploitation allows privilege escalation on systems running a vulnerable version. Node.js and Google released stable fixes on October 21, with public disclosure following on October 22, according to BleepingComputer. Proof-of-concept exploits exist, but there are no reports so far of attacks in the wild.
Brotli flaw: how HTTP2Shell works
The bug is a buffer overflow. A specially crafted Brotli-compressed stream triggers an invalid block switch that the decoder wrongly treats as a request for more input. Node.js explains in its advisory that the streaming decoder then keeps appending input bytes to an internal eight-byte buffer, writing past its bounds and corrupting nearby memory.
An attacker only needs an application to decompress malicious data. That can happen by serving a compressed HTTP response to an app fetching a URL, or by sending a compressed request straight to a server. The flaw is named HTTP2Shell because of its impact on HTTP clients and servers, but it is not limited to HTTP/2, and cybersecurity firm Imperva has confirmed that exploiting it can lead to remote code execution.
- Brotli 1.0.3 through 1.0.9, 1.1.0 and 1.2.0 are affected
- Flaw type: buffer overflow in the streaming decoder
