Affected Systems
Brotli C decoder library versions 1.0.3–1.0.9, 1.1.0, and 1.2.0. Affects Node.js (versions prior to 22.23.4, 24.22.1, 26.12.1), Python HTTP clients (urllib3[brotli], requests, httpx, aiohttp[speedups]), .NET, and any application decompressing attacker-controlled Brotli data. Vulnerability tracked as CVE-2026-111497, also known as HTTP2Shell, Broccoli2Shell, and Node2Shell.
Exploitation Status
Proof-of-concept exploits published. Confirmed RCE capability by Imperva. No reports of active exploitation in the wild as of disclosure.
Business Impact
Buffer overflow in Brotli decoder allows remote attackers to crash processes, expose memory contents, and achieve remote code execution by serving malicious compressed HTTP responses or requests. Affects web servers, HTTP clients, and any service decompressing Brotli data. Microsoft issued emergency .NET patches citing privilege escalation risk. Updating system Brotli library does not fix bundled copies in Node.js or containerized applications—requires process restarts and container rebuilds.
Urgency
🔴 Immediate
Recommended Actions
- Update immediately: Google Brotli to 1.0.10/1.1.1/1.2.1, Node.js to 22.23.4/24.22.1/26.12.1, Python Brotli to 1.2.1, Python brotlicffi to 1.2.1.0, and apply Microsoft .NET emergency patches.
- Restart all affected Node.js processes and rebuild/redeploy container images after patching—system library updates do not fix bundled Brotli copies.
- If immediate patching is not feasible, remove Brotli support from Python applications and block incoming Brotli-compressed requests (Content-Encoding: br) at proxy or firewall level.
- Monitor for exploitation attempts by inspecting HTTP traffic logs for Brotli-compressed payloads (Content-Encoding: br) and correlate with process crashes or unexpected memory access patterns.
- Inventory all applications using Brotli decompression (Node.js, Python HTTP clients, .NET services) to ensure comprehensive patch coverage across environments.