HTTP2Shell Beyond Node.js: Python, .NET and Bun

Brotli is a way of making data smaller before it travels over the internet, and a large share of web traffic uses it. The code that unpacks Brotli data had a mistake that let specially crafted data write into memory it should not touch. Node.js was the first place anyone reported it, which is why it was first called Node2Shell. Then people checked other software that carries the same unpacking code, and found it in many places. This page lists those places and what to update. The complete PHP2Shell and Node2Shell guide covers the wider picture.

What is the vulnerability, exactly?

It is CVE-2026-111497, also called Node2Shell, HTTP2Shell and Broccoli2Shell. The flaw sits in Google's Brotli C decoder. Vendors name three possible results: a crash, a memory leak and, in some cases, remote code execution. The CVE record, assigned by Google, scores it 9.2 on CVSS 4.0.⁠¹

The version numbers need careful reading, because the affected span and the fixed releases overlap numerically. The advisory says Brotli 1.0.3 through 1.2.0 is affected and that users should move to 1.0.10, 1.1.1 or 1.2.1.⁠¹³ Each fix belongs to its own release branch. Read it by branch:

So 1.1.1 is a fixed release, not an affected one, even though it sits numerically inside "1.0.3 through 1.2.0". Debian's tracker records the introducing change as version 1.0.3 and a separate fixing commit for each of the three branches.⁠⁸ The advisory states one range and three fixed releases. The branch-by-branch listing above is my reading of that text, and it matches the per-branch lists in Tanium's and Wiz's write-ups.⁠¹⁠⁷ Upstream released the fixed versions on 21 October 2026. Tanium says the upstream fix was committed on 27 February with no advisory.⁠¹

Reported CISA added it to the Known Exploited Vulnerabilities catalog on 27 October and gave no attack detail.⁠² Reports put the federal deadline at 10 November.⁠³⁠⁴ Status as of 4 November 2026.

Despite the "HTTP2Shell" name, this has nothing to do with the HTTP/2 protocol.⁠¹ The name changed because the bug lives in the library, not in one runtime.

Where else is it, and what do I update to?

Each copy of the decoder is fixed by whoever ships it. Read the "Note" column, because several rows depend on how the product is configured or built.

How I checked these numbers: I read Microsoft's .NET post, Debian's tracker and a complete copy of Ubuntu's USN-8956-1 directly. Python's ranges come from the Brotli advisory record. The Bun, Envoy, Istio and Go figures come from those projects' advisories (Bun GHSA-663w-cv8g-jj2p, Envoy GHSA-3wvj-j6qm-62mr, Istio ISTIO-SECURITY-2026-007) as relayed by Tanium, Wiz and Field Effect, which agree with each other. I could not open the advisories themselves. Confirm those four rows against the projects' pages before you act on them.

Tanium reported on 24 October that Red Hat, SUSE, Amazon Linux 2023 and Fedora had no fix yet.⁠¹ I did not recheck those, so read your vendor's tracker before assuming anything. Distribution fixes move quickly.

What does finding your copy look like?

Take a Python service that calls a partner API with requests. The response comes back Brotli-compressed, and the library unpacks it with its own Brotli copy. Per Tanium, urllib3, requests, httpx and aiohttp decode Brotli automatically whenever Brotli or brotlicffi is installed, and your code never has to import either.⁠¹

So the first question is which copy your service has. In the environment that runs the service, ask pip:

python -m pip show Brotli brotlicffi

For a container, run the same command against the live container with docker exec <container> python -m pip show Brotli brotlicffi. The output gives each installed package's Version and Location. If the version is below 1.2.1 for Brotli, or below 1.2.1.0 for brotlicffi, that copy is yours to fix: upgrade it, regenerate your lockfile, rebuild the image and restart the service. If the package came from your Linux distribution (python3-brotli), the fix arrives through your distribution's update instead.

The same output has a Required-by line, but treat it carefully. It can be empty, and it does not reliably show why a package was installed. To find which dependency pulled Brotli in, use a dependency-tree tool such as pipdeptree in reverse mode for that package, or read your lockfile.

Nothing in this example touches the bug itself. The point is only that someone has to find the copy and own the fix.

How do I find every copy?

Brotli rarely shows up as an application, because it is compiled into other things. Tanium's list of where copies hide is a good checklist:⁠¹

• Node.js runtimes installed outside package managers, such as nvm, fnm, Volta and Homebrew.
• Applications that ship their own Node.js, including desktop apps and developer tools.
• Python environments, which often get Brotli as a transitive dependency of an HTTP client.
• Bun binaries, including standalone executables.
• System libbrotli packages.
• Container images, which keep the runtime from the day they were built.
• Go and Java libraries, proxies such as Envoy and Istio, and Electron apps.

For software that vendors Brotli's source, one clue is the new error name BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, which the upstream fix adds.⁠¹²⁠¹³ Finding it in a copy suggests the fix is present. Not finding it is only a lead that the copy may be unfixed. Vendors can backport a fix under different code, modify the implementation or use another code path, so the name is not a vulnerability test. The vendor advisory, the patch diff or a verified fixed build is what settles it.

A software bill of materials (SBOM) helps here, and Tanium says scanners were slow to map this CVE to the Python packages.⁠¹ So don't read a quiet scanner as proof that you have no copies.

Who is exposed in practice?

Exposure needs two things: a vulnerable decoder, and a path for attacker-controlled Brotli data to reach it. Both directions count. A server can decompress a request body, and a client or service can decompress a response from a server it fetches. Tanium names URL previews, webhook targets and crawlers as examples of the second direction.⁠¹

Some products only reach the decoder when a feature is turned on. In .NET, ASP.NET Core request decompression and automatic HttpClient response decompression are not on by default.⁠⁶ Envoy and Istio are exposed only when a Brotli decompressor is configured.⁠¹ For Node.js, Node's advisory names data an application decompresses with node:zlib.⁠⁵ Whether your web server is affected has its own page: whether your web server is affected.

Exposure through a feature being off is not the same as no copy. Patch the copies anyway. Features get turned on later.

What do I do?

1. Inventory every copy, using the list above.
2. Patch each ecosystem on its own schedule, using the table.
3. Rebuild and redeploy container images, and rebuild self-contained apps and Bun executables.
4. Restart every process, because a running process keeps the decoder it loaded.

If you can't update right away, Tanium lists interim steps: reject requests with Content-Encoding: br at your WAF or proxy, remove the Brotli decompressor filter in Envoy or Istio, and uninstall Brotli and brotlicffi in Python, which makes HTTP clients fall back to gzip.⁠¹ These are bridges, not equivalents of patching. A WAF covers inbound requests only, not Brotli responses your own code fetches. For Express, see how an Express app decodes Brotli.