Critical Brotli decoder flaw, dubbed HTTP2Shell, draws emergency patches

A critical buffer overflow in Google's Brotli C decoder, tracked as CVE-2026-111497 and nicknamed HTTP2Shell, can let an attacker corrupt memory and read sensitive data, according to Bleeping Computer, which reported the flaw on October 26, 2026.

The bug sits in the decoder's handling of a malformed block switch. Node.js says the streaming decoder treated an invalid block switch as a temporary need for more input rather than a permanent format error, so it kept appending bytes to an eight-byte internal buffer and wrote past its bounds. An attacker only needs to get an application to decompress a crafted Brotli stream, for example by serving a malicious compressed HTTP response or sending a compressed request to a server.

The impact reaches beyond Node.js. The report names Python HTTP clients such as urllib3[brotli], requests, httpx and aiohttp[speedups] when they use a vulnerable decoder, and notes Microsoft pushed an emergency .NET update. Node.js and Google released stable fixes on October 21, with public disclosure the next day.

Patched versions listed by the report include Google Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, Python Brotli 1.2.1 and Python brotlicffi 1.2.1.0.

Proof-of-concept exploits are public, but the report says there are no known in-the-wild attacks. Defenders should update, restart affected processes and rebuild container images. Updating a system Brotli library alone won't fix apps that bundle their own copy, and blocking inbound Brotli requests still leaves the malicious-response path open.

CVE references

CVE-2026-111497