HTTP2Shell Is a Brotli Bug, Not a Node.js One, and Its Fixes Span PyPI, Envoy, Istio and Bun

An attacker who can get an application to decompress a crafted Brotli stream (no login, but the target must decode attacker-supplied data) can corrupt that process's memory through CVE-2026-111497, which carries a CVSS v4.0 score of 9.2.

Node.js shipped fixes on October 21 in versions 22.23.4, 24.22.1 and 26.12.1. On October 23 the security firm Aikido began calling the flaw HTTP2Shell, on the argument that the bug lives in Google's Brotli decoder and reaches every program that bundles it. The Terminal covered the Node.js release itself on October 22.

What the Node.js advisory says

The Node.js security release post rates the flaw High and credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer for the report, with mcollina and aduh95 fixing it. Its description is specific about the mechanism: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer."

The bug is one function returning a single error code for two different situations, and the caller trusting it. The impact the post lists is a crash, disclosure of process memory, or remote code execution.

Which versions carry the fix

GitHub's advisory GHSA-9v8h-qqgm-4m35 covers the PyPI packages brotli (1.0.3 up to 1.2.1) and brotlicffi (1.0.3 up to 1.2.1.0), and describes the vector as network-reachable with no privileges or user interaction. It was published to the GitHub Advisory Database and NVD on October 22 and updated October 23. Aikido's write-up and the Brandefense analysis supply the rest of the fix list.

Component	Fixed in	Source
Node.js 26.x, 24.x, 22.x	26.12.1, 24.22.1, 22.23.4	Node.js
Google libbrotli	1.0.10, 1.1.1, 1.2.1	Aikido
PyPI brotli	1.2.1	GitHub advisory
PyPI brotlicffi	1.2.1.0	GitHub advisory
Bun (1.4.3 and earlier affected)	1.4.4	Brandefense
Envoy	1.40.0, 1.39.3, 1.38.6, 1.37.8	Aikido
Istio	1.29.9, 1.30.6, 1.31.2	Aikido

Upstream, the correction was committed in February 2026 but no Brotli release carried it until this week, according to Aikido's analysis.

Python clients load Brotli without being asked

Aikido says urllib3 and requests, httpx with its brotli extra, aiohttp and Scrapy use the packages automatically when they are installed. It counts 82.8 million monthly downloads for Brotli. Aikido also said advisory databases had not mapped the CVE to the PyPI packages as of October 23, so pip-audit, Dependabot and Safety might not flag it.

GitHub's own database lists both packages, so the gap may be one of timing, and The Terminal did not run any of those scanners to check. Aikido is a vendor of security tooling, and its claim about scanner coverage is its own.

On the JavaScript side, Brandefense reports that Express 5 with express.json() decodes br request bodies by default and is exposed, while Express 4.21.2 through 4.22.3 returns a 415 for Brotli bodies. Server-side fetch() goes through undici, which decodes Brotli responses, so only the runtime patch covers it.

Code execution or crash: the evidence is split

Node.js lists remote code execution as a possible outcome. Aikido says researchers ran code on the official Node.js 24.22.0 image, not on every attempt, and that 24.22.1 rejects the same input. Brandefense adds that public proof-of-concept code exists on GitHub, that some of it only crashes unpatched Node.js, and that one analysis argues the impact is denial of service.

An independent test by Ikesan on the Lilting Channel, run on an M4 Mac mini against Node.js v24.22.0 and v24.22.1, fed the invalid test data to both builds and got an error from each, with different codes. The author wrote that this cannot show whether the out-of-bounds write occurs.

As of 22:00 UTC on October 23, Brandefense reported the flaw was not in CISA's Known Exploited Vulnerabilities catalog, and that CISA's data in the CVE record lists exploitation as none.

What to do if you cannot upgrade yet

Upgrade first. Where that is impossible, Aikido suggests rejecting requests with a Content-Encoding containing br at the proxy or middleware layer. Removing br from Accept-Encoding is not enough, it says, because a malicious server can still send Brotli responses. Brandefense adds express.json({ inflate: false }), which also rejects gzip bodies, so clients need testing first.

The same week, PHP shipped its own emergency fix for two out-of-memory RCE bugs, so patch queues are crowded. Node.js 25 reached end of life on June 1, 2026, according to the Lilting Channel, and Brandefense says 20.x and 18 have no published fix. As of the same October 23 snapshot, Brandefense listed Debian's trixie, forky and unstable brotli packages as still vulnerable.