Node2Shell / HTTP2Shell (CVE-2026-111497): Brotli Library RCE

On October 21, 2026, Node.js fixed CVE-2026-111497, a critical vulnerability now known as Node2Shell and, since October 24, HTTP2Shell. The vulnerability is in Google’s Brotli library itself, the decoder that unpacks Brotli-compressed data. Node.js shipped the first runtime fix. Bun, Python’s Brotli packages, Envoy, Istio and Electron are also affected because they use the same library.

A crafted compressed stream makes the decoder write data outside the memory set aside for it, known as an out-of-bounds write. That can overwrite data the application relies on, so an attacker can crash the application, leak memory or run attacker code. Public proof-of-concept code was published within 24 hours. AppTrana WAAP blocks the inbound attack path for any backend behind it. Patching is still required to close the paths a WAF cannot see.

Risk Analysis

Node2Shell: From Patch to Public PoC in 24 Hours

What is Node2Shell (HTTP2Shell)?

Node2Shell is a memory-safety vulnerability in Google’s Brotli decoder library, versions 1.0.3 to 1.2.0. Node.js bundles this library in its zlib module, and many other runtimes, proxies and packages use it.

An attacker crafts a Brotli stream that is deliberately malformed: it declares one type of data block, then asks the decoder to switch block types. The decoder should stop with an error. An unpatched decoder ignores the error and keeps going, so it writes past the end of its buffer. The fix (Brotli commit 0ed4268a) stops decoding with a new error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH.

An attacker needs an application to decompress Brotli data that the attacker controls. This can happen in four ways:

Some Linux distributions and runtimes are still waiting for a fix. Red Hat Enterprise Linux 8, 9 and 10, the .NET runtime, the PHP Brotli package, and the Debian and Ubuntu nodejs packages have no patch yet. Amazon Linux 2023 has fixed its brotli and nodejs24 packages, though its nodejs and nodejs20 packages have no fix planned. Debian 12 and 13 and Alpine have also shipped fixed brotli packages.

Keep in mind that Node.js and Bun bundle their own copy of Brotli, so updating the OS package does not protect them. Upgrade the runtime itself.

What Node2Shell Means for Your Web Infrastructure

How to Detect Node2Shell

Find every Node.js, Bun, Python, Envoy, Istio and Electron runtime, including containers and CI. Then look for these signs from October 21 onwards:

Node2Shell: Mitigation and Remediation

Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, Python Brotli to 1.2.1, brotlicffi to 1.2.1.0, and Envoy and Istio to the fixed versions listed above. Rebuild container images with docker build --pull, restart services, and rotate secrets if you find signs of compromise. Until you can patch, these settings reduce exposure:

// Confirm the fix (run in a shell): prints -17 when patched
node -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH"

// Express 5: stop decoding compressed request bodies
app.use(express.json({ inflate: false }));

// axios / got: turn off response decompression
axios.get(url, { decompress: false });

Python: Upgrade Brotli and brotlicffi, or uninstall them where they are optional. requests, urllib3, httpx and aiohttp stop requesting Brotli when neither package is installed.

Envoy and Istio: Upgrade, or turn off the Brotli decompressor until you can.

A WAF blocks the inbound path, but it cannot see Brotli responses your application fetches. Patching is the only complete fix.