Another “2Shell,” and this one hides inside a compression library. BleepingComputer reports that CVE-2026-111497 (also called HTTP2Shell, Node2Shell and Broccoli2Shell) is a buffer overflow in Google’s Brotli decoder. A crafted Brotli stream can crash a process, leak memory, and, per Node.js and Imperva, lead to remote code execution.
Who’s affected
- Brotli 1.0.3 through 1.0.9, 1.1.0 and 1.2.0.
- Node.js, which bundles its own copy.
- Python clients like urllib3[brotli], requests, httpx and aiohttp[speedups] when they use a vulnerable decoder.
- .NET. Microsoft pushed an emergency update on Sunday.
Fixed versions
- Brotli 1.0.10, 1.1.1, 1.2.1
- Node.js 22.23.4, 24.22.1, 26.12.1
- Python Brotli 1.2.1 and brotlicffi 1.2.1.0
What to do
- Patch, then restart the processes, and rebuild and redeploy container images.
- Updating the system Brotli package doesn’t fix apps that bundle their own copy, like Node.js.
- Can’t patch yet? Drop Brotli support in Python apps and block inbound Brotli-compressed requests at the proxy. Remember that malicious responses are still a path.
Public PoCs exist, but there are no reports of exploitation in the wild yet.
My take
This is the sneaky kind. You don’t think of “decompress a response” as attack surface, but every bot that fetches URLs does it. Update your Node and Python environments today.
God Bless, and Needs Garlic!
