Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A severe memory-corruption bug in Brotli, Google's compression library embedded in Node.js and many other tools, has forced vendors to rush out fixes. Tracked as CVE-2026-111497 and nicknamed 'HTTP2Shell,' 'Broccoli2Shell' or 'Node2Shell,' the flaw stems from a buffer overflow where a malformed compressed stream tricks the decoder into endlessly writing past an 8-byte internal buffer, corrupting adjacent memory. Researchers at Imperva showed this can be escalated into remote code execution, and the issue reaches beyond Node.js into .NET (patched by Microsoft on an emergency basis) and Python libraries like urllib3, requests, httpx and aiohttp. Affected Brotli versions span 1.0.3–1.0.9, 1.1.0 and 1.2.0; fixed releases include Brotli 1.0.10/1.1.1/1.2.1, Node.js 22.23.4/24.22.1/26.12.1, and updated Python brotli/brotlicffi packages, though no active exploitation has been confirmed despite public proof-of-concept code. Admins are urged to update, restart affected services, rebuild containers, and—where patching isn't yet possible—disable Brotli support or block compressed Brotli traffic at the network edge.