The Eight-Month-Old Bug That Forced the Whole Web to Patch at Once

The Eight-Month-Old Bug That Forced the Whole Web to Patch at Once

It Was Never About HTTP/2

Despite the name, HTTP2Shell has nothing to do with the HTTP/2 protocol itself. The flaw sits in the C decoder of Google's Brotli compression library: a crafted compressed stream drives the decoder's block-type state machine into an invalid state and writes past a buffer. A process that decompresses attacker-controlled Brotli data can crash, leak memory, or, under the right conditions, hand over remote code execution. Aikido Security coined the HTTP2Shell label because Brotli is lodged inside nearly the entire HTTP ecosystem — the name is theatrics, the blast radius is not.

One CVE, Three Nicknames, a 9.2 Score

The issue is tracked as CVE-2026-111497, also called Node2Shell and Broccoli2Shell. Google, acting as the numbering authority, scored it 9.2 Critical under CVSS v4.0. Node.js disclosed it on October 21, crediting Khai Tran and Sylvie Mayer of OpenAI's Codex Security team for the report and Matteo Collina and Antoine du Hamel for the fix. The technical classification is consistent across outlets: an out-of-bounds write, CWE-787, paired with an unchecked return value, CWE-252.

Fixed in February, Shipped in October

The most remarkable detail, documented by WebProNews, is that the upstream fix had been committed to Brotli's source tree since February — yet no release carried it until October 21, when Node.js and Google shipped synchronized stable fixes, with public disclosure the next day and the PyPI package following on October 23. For roughly eight months the patch sat in a public commit waiting to be packaged. Node.js moved its three supported lines to 22.23.4, 24.22.1 and 26.12.1, while the library itself went to 1.2.1, with 1.1.1 and 1.0.10 covering the older series.

The Victim List Goes Far Beyond Node

The vulnerable Brotli ranges are 1.0.3 through 1.0.9, plus 1.1.0 and 1.2.0. But Brotli lives in far more than Node.js: Bun needs 1.4.4, Python's Brotli package needs 1.2.1 and brotlicffi 1.2.1.0, PHP reissued four Windows builds including 8.5.12-1, Microsoft pushed an emergency .NET update, and Envoy and Istio are patching too. As The Hacker News notes, the Python angle is the sneakiest: the mere presence of the Brotli or brotlicffi package makes clients such as requests, urllib3, httpx and aiohttp decode Brotli responses on their own, so an application can be exposed without ever importing Brotli. Separate reports add .NET applications, FFmpeg libraries, ClickHouse servers and Apache Arrow workloads to the affected list. End-of-life Node.js lines, 20.x and older, are affected and will never receive a fix.

Code Execution Proven, In-the-Wild Attacks Unreported

Imperva's Red Team reported on October 22 that it demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image — no instrumented build required, though several attempts were needed — while the same input was rejected by the fixed 24.22.1. Crash, memory disclosure and shell are therefore all on the table. As of October 25, however, no attacks in the wild had been publicly reported, so defenders still have a patching window. One clarification: the Citrix NetScaler zero-days Google warned about in late September are a separate incident and should not be conflated with this Brotli flaw.

Find Every Copy First, Then Patch

Tanium and several other outlets prescribe the same order of operations: inventory every bundled copy of Brotli first, because updating the system library does not fix applications that ship their own copy — and plenty do. Teams that cannot patch immediately should block incoming Brotli-compressed traffic at a proxy or firewall, or disable Brotli decoding; merely removing br from Accept-Encoding is not enough, since a server may send it anyway. With Node.js 26 set to become long-term support on October 28, upgrades can ride along. The lesson of the eight-month gap is uncomfortable: the fix existed, the release did not.