HTTP2Shell flaw in Brotli compression forces emergency patches

A critical vulnerability in the Brotli compression algorithm, dubbed HTTP2Shell, has prompted emergency patches from Google, Microsoft, and Node.js. The flaw, tracked as CVE-2026-111497, could enable remote code execution and affects widely used software like Node.js, Python packages, and .NET applications.

Tarun Mottlia

Editor, Lazyfounder

Published Oct 28, 20262 min read

HTTP2Shell flaw in Brotli compression forces emergency patches — Image: Shutterstock) via source

What HTTP2Shell exposes

The HTTP2Shell vulnerability, tracked as CVE-2026-111497, is an out-of-bounds write flaw in the Brotli compression algorithm. It carries a critical severity score of 9.2 out of 10 and could enable remote code execution, memory corruption, or denial of service attacks. Brotli is widely used to compress HTTP responses like HTML, CSS, and JavaScript, making this flaw potentially impactful for millions of websites and applications.

Affected software and patches

The vulnerability affects a range of widely used software, including Node.js, Python packages (Requests, urllib3, httpx, aiohttp), .NET applications, and HTTP clients. Google released patches for Brotli on October 21, 2026, with versions 1.0.10, 1.1.1, and 1.2.1. Microsoft followed with an emergency update for .NET, while fixes for PyPI packages became available on October 23, 2026. Node.js has no complete workaround, requiring users to apply patches immediately.

Exploitation risks and mitigations

Proof-of-concept exploits for HTTP2Shell already exist, though no malicious exploitation has been confirmed. A dedicated website, Broccoli2Shell.com, tracks vulnerable versions and reports on exploitation attempts. System administrators are advised to apply patches immediately, restart affected processes, and rebuild container images. Python users can mitigate risks by uninstalling vulnerable Brotli and brotlicffi packages or removing optional dependencies like httpx[brotli].

What this means

Lazyfounder analysis — our interpretation, not reported fact.

HTTP2Shell is a reminder that foundational open-source components—especially those handling compression or parsing—remain high-value targets for attackers. For founders and operators, this incident underscores two operational realities: first, the need for real-time visibility into dependencies, as even indirect use of Brotli through libraries like httpx or urllib3 creates exposure; second, the urgency of automated patch management, since manual updates are unlikely to scale across containerized environments or microservices. The lack of a Node.js workaround also highlights how some ecosystems lack graceful fallback options, forcing teams to accept downtime for critical updates.

Sources

TechRadar · 2026-10-27
Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites

This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.

About the author