Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

What happened

On October 21, 2026, Node.js disclosed the flaw. Days later, Python packages and other major languages and web services were found to be affected too. Some patches were not yet ready when the news spread. Security teams are told to check whether they use Brotli, upgrade fast, or turn off Brotli decoding if no patch exists.

Key numbers and facts

• The flaw affects Brotli versions 1.0.3 through 1.2.0.
• It has a CVSS v4.0 score of 9.2, which is rated Critical (the top danger level).
• Brotli 1.2.1 and brotlicffi 1.2.1.0 are the fixed versions.
• OpenAI found the bug in February, but it was not treated as a security issue until now.

What Brotli is and how the bug works

Brotli is a way to make data smaller so it can be stored or sent over the internet. Web servers and apps use it to shrink pages, styles, and scripts. The bug lets the decoder keep accepting data it should reject. The extra data overflows a small working space in memory. An attacker can use that damage to control what the program does.

Why it matters

Many HTTP tools load Brotli on their own when it is installed, so many apps may be exposed without their owners knowing. A bad server could also attack a client that accepts compressed replies. Because the fix shipped in source code months earlier without a security label, every project that bundles Brotli must release its own update. Automatic scanning tools may not flag the risk yet.

What to watch

• Patches for libbrotli, Python, C++, Node.js, bun, and Envoy are coming or already out.
• Check your Node.js, Python, and container images for Brotli 1.2.0 or earlier.
• Watch advisory databases to see when they link this CVE to PyPI packages.
• Apache and Nginx do not decode Brotli by default, but check your setup.