Brotli decoder flaw CVE-2026-111497 spreads from Node.js to Python, Envoy and beyond

What happened

A critical vulnerability in Google's widely deployed Brotli compression library has widened from a single-runtime problem into an ecosystem-wide one. According to Aikido, Node.js disclosed the flaw — nicknamed "node2shell" — on Wednesday, October 21. The following day, Python confirmed its packages were also affected, and by Friday, October 23, it had become clear the issue reaches into many languages and HTTP service applications, with fixes still rolling out. As the blast radius grew, the issue has become known as "HTTP2Shell".

The vulnerability, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decoder present in versions 1.0.3 through 1.2.0 on all platforms. It carries a CVSS v4.0 score of 9.2, rated Critical. A remote, unauthenticated attacker who gets a maliciously crafted Brotli stream to a vulnerable decoder can corrupt memory, leak sensitive data, crash the process or, in the worst case, execute arbitrary code.

How the flaw works

Aikido explains that the decoder fails to reject extra input at the point where it should stop reading. The surplus bytes spill past a small working buffer and damage the program's memory, and that damage can be turned into control over what the process executes.

Because Brotli is a standard HTTP content encoding, the attack can travel in either direction: a hostile client can compromise an unpatched server that decompresses request bodies, and a hostile server can compromise an unpatched client that accepts compressed responses. In Python environments, exposure is easy to miss — Aikido notes that HTTP clients such as requests, httpx and aiohttp load the Brotli and brotlicffi packages automatically whenever they are installed.

A fix that sat unshipped since February

Per Aikido, OpenAI discovered the vulnerability in February and reported it as an unauthenticated remote code execution that works in both directions. The root cause was fixed in the Brotli source code at the time, but it was not recognised as a security issue and no release carrying the fix shipped until now. That delay means every project that bundles Brotli has had to prepare its own update, which is why patches have arrived piecemeal across the ecosystem this week.

Patched versions

By the afternoon of October 23 Pacific time, Aikido reported patches available for libbrotli, Python, C++, Node.js, Bun and Envoy, with more arriving. The fixed releases it lists:

• Node.js: 22.23.4, 24.22.1 or 26.12.1, or newer in a supported release line
• Google Brotli upstream: 1.2.1, or patched 1.0.10 / 1.1.1 for older branches
• Python packages: Brotli 1.2.1 and brotlicffi 1.2.1.0
• Bun: 1.4.4, including rebuilds of compiled executables that bundle it
• Envoy: 1.40.0, 1.39.3, 1.38.6 or 1.37.8 (1.36.12 also contains the fix, but that branch is unsupported)
• Istio: 1.29.9, 1.30.6 or 1.31.2, keeping in mind the 1.29 branch is end of life
• curl / libcurl: update the Brotli dependency to 1.2.1 or a vendor security build; statically linked copies require a rebuilt application

Aikido also notes that Apache and Nginx do not decode Brotli by default. For operating-system packages, vendors may backport the fix without changing the upstream version number, so version checks alone may not tell the whole story.

Workarounds while you wait

Where no patch is available yet, Aikido recommends disabling Brotli decoding entirely. For Python, that means uninstalling both Brotli and brotlicffi and removing extras such as httpx[brotli] that would pull them back in; gzip and deflate support remains intact. For incoming traffic, reject requests whose Content-Encoding includes br at the reverse proxy, load balancer or middleware — matched case-insensitively, including within lists — before any vulnerable decoder touches the body. For outbound traffic, drop br from Accept-Encoding and reject Brotli responses before decoding begins.

Aikido cautions that editing Accept-Encoding alone is not sufficient, since a malicious server can send Brotli regardless of what the client advertises. One further gap: as of October 23, advisory databases did not map the CVE to the two Python packages, so tools like pip-audit, Dependabot and Safety would not flag vulnerable installs.

Why it matters

Brotli sits on the decompression path of a huge share of web traffic, and this bug turns that routine step into a potential remote code execution vector in both client and server directions. Because the upstream fix existed but was never released for months, remediation is fragmented across dozens of vendors, runtimes and bundled copies, and part of the Python exposure is invisible to common dependency scanners. Any system that decompresses data it does not fully trust — API gateways accepting compressed request bodies, crawlers and HTTP clients fetching compressed responses — should treat this as an immediate patch-or-disable decision, then rebuild images, redeploy and verify that running workloads actually use the patched components.