A Google Brotli flaw now threatens HTTP libraries far beyond Node.js
Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0, was first disclosed as Node2Shell for Node.js and then spread to Python packages with 82.8 million monthly downloads. OpenAI found the bug in February, but it shipped without a security fix until now, so every project bundling Brotli must release its own patch. Patches exist for libbrotli, Node.js, Python, Bun, Envoy, and Istio; where none is available, disable Brotli decoding.
A malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses.
- netsharc
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
- pimterry
Much prefer the Broccoli2Shell name & site (for the same vuln): https://broccoli2shell.com/. For starters, I'm pretty sure you can hit this without HTTP if you do any manual Brotli decoding, HTTP just happens to be the most common case that comes up.
- Rapzid
> reported it as unauthenticated remote code execution that works in both directions
> but it wasn't recognized as a security issue at the time and no release shipped with the fix until now
I'm always getting my dangerous RCE bugs mixed up with my harmless RCE bugs.
I'm curious how this was reported and fixed back in Feb but nobody recognized the importance. A case of AI automation and nobody at the wheel?
- nairboon
Brotli2Shell seems to be a more appropriate name for this.
- bawolff
To me, the surprising part is how many of these implement brotli compression of request (not just response) bodies, given how obscure a feature that is.
In any case all this sensationalism is starting to get annoying. Patch your stuff and move on.
Edit: actually, between all the sensationalism, its hard to tell from the article how many of these actually support brotli compressed request bodies in common configs vs some other use of brotli (which is bad but nowhere near as critical)
- cowsandmilk
Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
- flyingjoe
A few month ago, everyone was advising to use cool-downs in your package upgrades. Now we're constantly overriding those because security incidents will be exploited immediately.
Guess that's just how it's gonna be from now on.
- tetha
Well at least we know about it while or before the giant patch effort for everything else goes on. Just put it onto the pile.
Who turned on hard mode this week?