Brotli vulnerability CVE-2026-111497 (HTTP2Shell): am I affected and what should I do?

What happened

On 21 October 2026 Google released new Brotli versions that close a critical vulnerability in the Brotli decoder:

• CVE-2026-111497 (GHSA-9v8h-qqgm-4m35): a buffer overflow in c/dec/decode.c. An attacker without login can use a crafted Brotli stream to overwrite adjacent decoder memory. Possible consequences according to the advisory: memory disclosure, crashes and potentially code execution. CVSS 4.0: 9.2, critical (AT:P, so the attack depends on preconditions).

The precondition is always the same at its core: an application decompresses Brotli data from a source it cannot trust. Examples are HTTP requests with Content-Encoding: br or responses from third-party servers that an HTTP client decompresses automatically.

Not only Node.js is affected, but any software that ships a vulnerable Brotli version. Node.js rates the issue “High” in its security release and describes the bug like this: an invalid block switch was reported as “needs more input” instead of a format error, and the decoder then wrote past an internal 8-byte buffer. The vulnerability is sometimes also called HTTP2Shell or Node2Shell.

Affected and fixed versions

According to their release notes, the Node.js releases contain a cherry-pick of the Brotli fix. Bun’s release notes for 1.4.4 list security fixes that affect Brotli among other areas, but no CVE number. Which Node.js lines still get updates is shown in the end-of-life overview.

Is it being exploited?

• The advisories from Brotli, Node.js and Envoy do not mention observed exploitation.
• CVE-2026-111497 is not listed in CISA’s KEV catalog (catalog of 23 October 2026, checked on 25 October).
• As of 25 October we know of no public proof of concept from an official source.

No KEV entry does not mean “it can wait”: the CVSS score is high and Brotli is part of a great many stacks. How to rank such vulnerabilities is explained in the article on CVSS, EPSS and CISA KEV.

Am I affected? How to check

Node.js and Bun on the running system:

node -v
bun --version

The Brotli version that ships with Node.js:

node -p "process.versions.brotli"

Python packages in the respective environment:

pip show brotli brotlicffi

curl and the Brotli version it is linked against (shown in the first line as brotli/x.y.z):

curl -V

System packages, for example on Debian and Ubuntu:

dpkg -l | grep -i brotli

In repos the versions are usually in the base image (FROM node:…, FROM oven/bun:…, FROM python:…), in .nvmrc or .node-version, in requirements.txt, poetry.lock or uv.lock and in CI configs. For Envoy, what matters is whether a Brotli decompressor (envoy.compression.brotli.decompressor) is configured.

The free check is faster: it checks your files for all the components above.

Pitfalls

Built-in Brotli copies. Many programs ship their own built-in copy of Brotli: official Node.js builds, Bun, the Python wheels of brotli and brotlicffi, executables built with bun build --compile, self-built nginx modules such as ngx_brotli. Updating the system package libbrotli does not change them. These programs need their own update or a new build.

Distributions work differently. According to the Debian security tracker, the Debian package nodejs uses the system library. There, updating the brotli package (Debian 12: 1.0.9-2+deb12u1, Debian 13: 1.1.0-2+deb13u1) and restarting the Node.js processes helps. What counts is your distribution’s security tracker, not the version number.

Clients are affected too. This is not only about servers. HTTP clients can decompress Brotli responses automatically, in Python for example as soon as brotli or brotlicffi is installed. If you fetch third-party URLs (crawlers, webhooks, link previews), you decompress data from an untrusted source.

Processes keep running. After the update, old Node.js, Bun and Python processes keep running the old code. With Docker this means rebuilding the image and replacing the container, for example:

docker compose build --pull && docker compose up -d

Package scanners don’t see it. Dependabot checks package-lock.json, but not the Node.js runtime itself and not the Brotli copy inside it. More in the comparison with Dependabot.

What to do now

1. List all systems and repos with Node.js, Bun, Python, curl, Envoy or their own Brotli.
2. Update Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, the Python packages to brotli 1.2.1 or brotlicffi 1.2.1.0, Envoy to the fixed version of your line, system libbrotli to your distribution’s fixed package.
3. Rebuild programs with a built-in Brotli copy, rebuild and replace containers.
4. Restart all affected processes.
5. Verify on the running system, for example with node -v and node -p "process.versions.brotli".

If you can’t patch right away

These measures do not replace an update, they only reduce the risk until then:

• Reject requests with br in Content-Encoding at the proxy or WAF if your application does not need Brotli-compressed uploads.
• Turn off automatic decompression of Brotli from untrusted sources, for example by sending Accept-Encoding without br in HTTP clients.
• For Envoy, remove the Brotli decompressor from the configuration if you don’t need it.

Sources

• GitHub Advisory GHSA-9v8h-qqgm-4m35 (CVE-2026-111497)
• Brotli 1.2.1 release notes
• Node.js: October 2026 Security Releases
• Node.js 24.22.1 release notes
• Bun 1.4.4 release notes
• brotlicffi on PyPI (changelog 1.2.1.0)
• Brotli on PyPI
• Envoy advisory GHSA-3wvj-j6qm-62mr
• Debian security tracker: CVE-2026-111497
• NVD: CVE-2026-111497