Check Point tracks active exploitation of Brotli decoder flaw

Check Point Research has published an analysis of a remote code execution flaw in Brotli decompression implementations, which it calls HTTP2Shell. The bug is tracked as CVE-2026-111497. In its threat intelligence report for the week of 2nd November, the firm says the flaw was initially associated with Node.js but may also affect other components, including Python packages, .NET and proxies.

Check Point says automated scanning and suspicious exploitation attempts have been observed, and that its IPS product blocks the activity. The report doesn't say who is doing the scanning, what they're after, or how many hosts have been hit. Nobody has published a public post-mortem of an intrusion built on it.

The CISA catalog entry for the same identifier describes a buffer overflow in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0, allowing a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose memory contents, cause a denial of service, or potentially execute arbitrary code with a crafted Brotli-compressed stream. It lists a CVSS 4.0 base score of 9.2 from Google and an update path to 1.0.10, 1.1.1 or 1.2.1.

If you ship anything that decompresses Brotli, check which library version is inside it, including the ones bundled in language runtimes and proxies. We'd start there rather than with the scanner alerts.

CVE references

CVE-2026-111497