Hatena
Serious vulnerability "HTTP2Shell" found in Google's Brotli compression format, broadly affecting web-related software; impact of "Node2Shell", discovered by OpenAI, expands, with risk of unauthenticated remote code execution
SecurityFirst seen 93 points
A serious security flaw was found in Brotli, a data compression tool made by Google. Some people call it "HTTP2Shell," and it can let attackers run code on a server without logging in.
What happened
A deep security hole, numbered CVE-2026-111497, was found in the C version of Brotli, a tool that squeezes data to make it smaller. The flaw is in the part that unpacks compressed data, called the decoder. An attacker can reach it remotely without a password. OpenAI first reported it as a Node.js problem and named it "Node2Shell." Later checks showed that many other web tools that handle HTTP traffic are also affected, so security firm Aikido Security and others began using the name "HTTP2Shell."
Key numbers and facts
- Severity score (CVSS 4.0): 9.2 out of 10, rated Critical
- Affected versions: Brotli v1.0.3 through v1.2.0
- Fixed versions released October 21: Brotli v1.0.10, v1.1.1, and v1.2.1
- Fixed Node.js versions include v22.23.4, v24.22.1, and v26.12.1
- Python packages Brotli and brotlicffi were also affected and fixed in v1.2.1 and v1.2.1.0
Some background
Brotli is used to shrink web pages and other files sent over HTTPS. When a site sends compressed content, it marks it with "Content-Encoding: br." Because so many web products use Brotli, one flaw can affect many programs at once. Note that this is not a flaw in the HTTP/2 connection itself. It affects the wider web system that uses HTTP.
Why it matters
If attackers exploit this flaw, they could damage memory, read private data from memory, crash a service, or even run their own code. Because the flaw affects many popular web tools, many companies and developers need to update quickly. Apps that include Brotli inside them must be rebuilt and redeployed, not just updated.
What to do now
- Update Brotli and any programs that include it to a fixed version
- Rebuild and redeploy apps and containers that bundle Brotli, including Bun single-file programs
- If you cannot update yet, turn off Brotli decoding for untrusted data. Gzip and deflate can stay on
- For Envoy Proxy and Istio, turn off the Brotli filter for both requests and responses
- Istio 1.29 is no longer supported, so move to version 1.30 or later
Glossary
- Brotli
- A compression tool from Google that makes files smaller so they load faster on the web.
- CVE-2026-111497
- The official ID number for this specific security flaw, so people can track it.
- CVSS 4.0
- A scoring system that rates how serious a security flaw is, from 0 to 10.
- Node.js
- A tool that lets programmers run JavaScript code on servers, not only in web browsers.
- Envoy Proxy
- A traffic manager that sits between users and servers and passes requests along.
- Istio
- A tool that manages how many small services talk to each other inside a computer network.