Can One Compressed Response Hijack Your Node.js or Python App?

One unchecked return value in Google's Brotli decoder is now a 9.2-rated remote code execution risk for Node.js, Python, Bun, Envoy and anything else that unpacks Brotli data. The bug started life as "Node2Shell" on October 21; by Friday, October 23, security teams were calling it HTTP2Shell, because it reaches far beyond Node.

Here's what you need to know:

• The flaw is CVE-2026-111497, an out-of-bounds write in Brotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1.

• It works both ways: a malicious client can attack a server, and a malicious server can attack a client that fetches its response.

• Fixed versions: Node.js 22.23.4, 24.22.1 and 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0, and Bun 1.4.4.

• Python apps can be exposed without ever importing Brotli, because requests, urllib3, httpx and aiohttp use it automatically when it's installed.

• As of October 23, there were no reports of exploitation in the wild, but researchers have shown code execution on an official Node.js build.

HTTP2Shell works in both directions: inbound request bodies and outbound fetches.

What Happened

On October 21, the Node.js project shipped security releases for its 26.x, 24.x and 22.x lines. The headline fix, according to the Node.js October 2026 security release notes, was a high-severity Brotli decoder bug that let malformed compressed input write past the end of an eight-byte internal buffer. Node credited OpenAI Codex Security researchers Khai Tran and Sylvie Mayer for the report.

The root cause sits upstream, in Google's C library. The NVD entry for CVE-2026-111497 says a crafted Brotli stream can let a remote, unauthenticated attacker corrupt decoder memory, leak sensitive memory, crash the process or potentially run arbitrary code.

Here's the bug in plain terms. When the decoder hits a block switch it can't complete, vulnerable versions treat "this stream is broken" and "send me more bytes" as the same answer, so they keep decoding. The upstream fix, Brotli commit 0ed4268, adds a real error code, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17), and stops on the first format error.

Then the blast radius grew. Upwind's HTTP2Shell analysis reports that Imperva's Red Team ran code on an unmodified Node.js 24.22.0 build, that GitHub advisory GHSA-9v8h-qqgm-4m35 confirmed the Python packages Brotli and brotlicffi carry the same decoder, and that Bun used the HTTP2Shell name in its October 24 advisory.

There's an awkward twist. Aikido Security's write-up says OpenAI found the bug in February, and the code was fixed then, but nobody flagged it as a security issue, so no Brotli release shipped the fix until October. Every project that bundles its own copy of Brotli now has to ship its own update.

Despite the name, this has nothing to do with the HTTP/2 protocol, as Tanium's advisory points out. It's about Brotli, the compression format behind a large share of web traffic.

Why It Matters

Brotli is everywhere. Aikido puts the Python Brotli package alone at 82.8 million downloads a month, and the same C decoder is compiled into runtimes, proxies and command-line tools.

The two-way attack is what makes this nasty. On the inbound side, a server or proxy that decompresses a request body sent with Content-Encoding: br hands attacker bytes straight to the decoder, often before any authentication. Tanium notes that Express 5 does this by default through express.json(), while Express 4 rejects Brotli bodies.

On the outbound side, your app becomes the victim when it fetches a URL. Webhooks, link previews, crawlers, "import from URL" features and build agents all count. Node's built-in fetch() decodes Brotli responses automatically, and Upwind says removing br from Accept-Encoding doesn't help, because many clients pick the decoder from the server's response header.

Kubernetes teams have one more layer to check. Upwind warns that a vulnerable Envoy or Istio proxy is exposed even when the app behind it is patched, and code running inside a pod can grab its service account token and mounted secrets.

It's also the second "2Shell" bug in a week. If you missed it, our coverage of PHP2Shell, the critical PHP RCE has the same patch-now lesson for PHP sites.

What It Means for Developers

The fix is mostly version bumps, but the hard part is finding every copy of Brotli you run. Start with internet-facing services that decode request bodies, then anything that fetches URLs you don't control.

• Node.js: upgrade to 22.23.4, 24.22.1 or 26.12.1. End-of-life lines (20.x, 23.x, 25.x) get no fix, so move off them.

• Python: run pip install -U "Brotli>=1.2.1" or pip install -U "brotlicffi>=1.2.1.0", then regenerate lockfiles. Use pip show Brotli brotlicffi and pipdeptree -r -p Brotli to find who pulls it in.

• Don't trust your scanner yet: as of October 23, pip-audit, Dependabot and Safety weren't flagging the PyPI packages, because advisory databases hadn't mapped the CVE to them.

• Bun, Envoy, Istio, curl: move to Bun 1.4.4, a patched Envoy branch (1.40.0, 1.39.3, 1.38.6 or 1.37.8), and patched Istio releases; rebuild curl or anything else that links Brotli statically.

• Rebuild and restart: a running process keeps the old decoder in memory, so rebuild images, redeploy and check the versions your live workloads report.

• Can't patch today? Reject requests with br in Content-Encoding at the edge, refuse Brotli responses before your client decodes them, or uninstall Python Brotli so clients fall back to gzip and deflate.

Am I exposed? A quick HTTP2Shell patch plan.

Supply chain hygiene helps here too. Our look at Composer 2.11's new dependency cooldown covers why knowing exactly what's in your dependency tree matters.

What's Next

Linux distributions are still catching up. Upwind's October 24 check listed Debian's brotli and nodejs packages as not yet fixed and Amazon Linux 2023 fixes as pending, with no fix planned for some older Node packages there.

Istio is another open question: fixed versions have been reported, but Upwind says there's no Istio bulletin yet. Watch for advisory databases to map the CVE to the PyPI packages, which will finally make Dependabot and pip-audit light up.

The big one is exploitation. According to The Hacker News, Imperva's working exploit took several tries and hasn't been released, CISA's October 23 assessment recorded exploitation as "none", and Red Hat said there's no reliable public proof-of-concept for running code. That kind of gap rarely stays open for long once a bug this widespread has a name.

FAQ

Is HTTP2Shell a bug in HTTP/2?

No. It's a bug in the Brotli decompression library. The name comes from how widely Brotli is used to compress HTTP traffic, not from the HTTP/2 protocol.

Am I affected if my code never imports Brotli?

Possibly. In Python, requests, urllib3, httpx and aiohttp decode Brotli automatically when the package is installed, and Node's fetch() and Express 5 body parsing use the bundled decoder.

Is HTTP2Shell being exploited right now?

As of October 23, there were no reports of exploitation in the wild and it wasn't in CISA's Known Exploited Vulnerabilities catalog. Researchers have shown code execution on an official Node.js build, so patch now anyway.

Sources

• Wednesday, October 21, 2026 Security Releases, Node.js

• Node.js 24.22.1 (LTS) release notes, Node.js

• CVE-2026-111497 detail, NIST National Vulnerability Database

• GitHub advisory GHSA-9v8h-qqgm-4m35, GitHub Advisory Database

• Brotli fix commit 0ed4268, Google Brotli on GitHub

• HTTP2Shell (CVE-2026-111497): one Brotli bug, RCE across the HTTP stack, Upwind

• Node2Shell evolves to HTTP2Shell, Aikido Security

• HTTP2Shell: Find and Fix Vulnerable Brotli Copies, Tanium

• Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software, The Hacker News

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane. Learn • Build • Share Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.