Brotli Vulnerability CVE-2026-111497 (HTTP2Shell): What to Do
Contents9
On 26 October 2026 Japan's JPCERT/CC issued an alert about CVE-2026-111497, a vulnerability in Brotli, a widely used data compression format. The next day the US agency CISA added it to its list of vulnerabilities known to be exploited in real attacks. Some reports call it "HTTP2Shell" or "Node2Shell".
Brotli is built into Node.js, .NET, Python, Linux and much more. This article explains how to tell whether you are affected, and what to do, step by step.
Key takeaways
- Even if you never installed Brotli, it may be inside your Node.js, .NET, Python or Linux. Check the version of each of those, not the Brotli version.
- Node.js → 22.23.4 / 24.22.1 / 26.12.1 or later. .NET → 8.0.33 / 9.0.22 / 10.0.14 or later. Python → brotli 1.2.1 or later.
- The danger is in decompressing data that arrives from outside. A website that only compresses the pages it sends is reported not to be affected.
- After updating, restart your programs and rebuild your containers.
9.2
CVSS 4.0 score (Critical)
Exploited
Confirmed by CISA on 27 Oct
No workaround
Update to a fixed version (JPCERT/CC)
Terms used here
Brotli = a compression format created by Google, commonly used to make websites load faster. On the network it appears as "br".
Decompression = turning compressed data back into its original size. This flaw is in the decompression step.
Vulnerability = a weak spot in a system that an attacker can use to get in.
What is the flaw, and why does it matter?
According to JVN, Japan's vulnerability database, Brotli's decoder could write data past the end of the memory it was given. Feeding it specially crafted compressed data can lead to:
Running the attacker's code
An attacker may be able to execute commands of their choice on the server.
Leaking information
The contents of the program's memory may leak out.
Service outage
The program crashes and the website or system becomes unavailable.
Attacks have already started
On 27 October CISA added the flaw to its Known Exploited Vulnerabilities list. A security firm reported seeing an exploitation attempt against unpatched Node.js (24.22.0) on 26 October. JPCERT/CC says there is no workaround and urges updating.
When is it dangerous? It depends on who decompresses
The bug is only in decompression, not in compression. So your risk depends on whether your systems decompress compressed data that comes from outside.
Decompressing data you receive Watch out
Your server automatically decompresses "br" data sent by users or partners. For example Node.js with Express 5 or Koa, or ASP.NET Core with request decompression turned on.
Fetching data from other servers Watch out
Features that pull information from external websites or APIs. The other server can send back malicious compressed data. For example webhooks, or a feature that reads the content of a URL you enter.
Only compressing your own pages Low risk
Compressing without decompressing is reported not to reach the bug. Another program on the same server may still decompress, though, so update anyway.
※ From the outside it is hard to tell which feature receives data from where. If you are not sure, updating every platform you use is the safest course.
Affected platforms and where to move
Brotli itself is fixed in 1.0.10, 1.1.1 and 1.2.1 (released 21 October). In most cases, though, Brotli lives inside another platform, so compare that platform's version with the table below.
| Platform | Status | Fixed version | Notes |
|---|---|---|---|
| Node.js 22 · 24 · 26 | Update | 22.23.4 / 24.22.1 / 26.12.1 or later | Fixed in the 21 October release |
| Node.js 20 and older | No fix | Upgrade to a supported line | End of life, so not fixed |
| .NET 8 · 9 · 10 | Update | 8.0.33 / 9.0.22 / 10.0.14 or later | Out-of-band update on 25 October. .NET 8 and 9 reach end of support on 10 November |
| .NET Framework | Not affected | — | Per Microsoft |
| Python (brotli) | Update | brotli 1.2.1 / brotlicffi 1.2.1.0 or later | requests, httpx and aiohttp may use it automatically when installed |
| Linux (Ubuntu, Debian…) | Per distribution | Your distribution's fixed package | Fixes available for Ubuntu 22.04 / 24.04 and Debian 12 / 13 |
Bun, Envoy, Istio and the Go Brotli library have also been fixed. The full October Node.js release is covered in "Node.js Security Release, October 2026".
The Brotli version number alone won't tell you
In Node.js, for example, the bundled Brotli still reports "1.2.0" both before and after the fix. Check the version of Node.js or .NET itself.
Timeline
- Google releases fixed Brotli versions. Node.js ships its fix the same day
- CVE published. Fix for Python (brotli 1.2.1) released
- Microsoft ships an out-of-band .NET update
- JVN and JPCERT/CC issue alerts. An exploitation attempt is observed abroad
- CISA adds it to the Known Exploited Vulnerabilities list (US federal deadline: 10 November)
Five steps to check and respond
- List the platforms you use
Do your website and business systems run on Node.js, .NET or Python? If you don't know, asking your developer or maintenance vendor is the fastest way.
- Check each version
If you can log in to the server:
node -vfor Node.js,dotnet --list-runtimesfor .NET, andpip show brotlifor the Python package. - Compare with the table and update
Update the operating system (Linux) packages too. Try it first in a test environment to make sure everyday work still runs.
- Restart and rebuild
Installing a new version doesn't change programs that are already running. Restart them, and rebuild and redeploy containers (Docker and so on) and self-contained applications.
- Check the logs for anything unusual
Look for programs that stopped suddenly or keep restarting. If anything looks suspicious, have a specialist investigate.
Can't update right away?
At the front door (reverse proxy or load balancer), reject "br"-compressed requests from untrusted clients to reduce the risk on the receiving side (Red Hat's advice). This does not protect features that fetch data from other servers, so use it only until you can update.
Leave it, or act now?
If you leave it
- A flaw attackers are already using stays open
- One malicious piece of data can take your service down
- At worst, your server can be taken over
If you update and redeploy
- This flaw is fixed
- You get the other Node.js and .NET fixes as well
- You can tell partners it has been dealt with
Questions to ask your developer or maintenance vendor
- Which of Node.js, .NET or Python does our system use, and which versions?
- When can you apply the fix for CVE-2026-111497 (Brotli)?
- Does the system decompress data from outside, or fetch data from other servers?
- After updating, will you restart the programs and rebuild the containers?
- Are we on any version that has reached or is about to reach end of support, such as Node.js 20 or .NET 8 and 9?
If you run versions that have reached or are about to reach end of support, such as Node.js 20 or .NET 8 and 9, see also "Securing Legacy Systems: Where to Start".
How Digi Dinos can help
Digi Dinos is a software company with offices in Vietnam and Japan. Over 8 years we have delivered more than 150 projects, and our team works in Japanese.
- Taking over maintenance of existing systems: Node.js, .NET, Python, Java, PHP, Ruby and more.
- Responding to new vulnerabilities: we assess the impact, apply the fix and redeploy.
- Full upgrades: languages, frameworks, servers and operating systems.
- No documentation? No problem: even when the original vendor is gone and nobody understands the system, we read the code, rebuild the documentation and propose a complete plan.
- Lifetime warranty: if a defect turns up in work we did, we fix it, with no time limit for as long as the maintenance contract continues.
Not sure whether your systems use Brotli? Free consultation.
From identifying your platforms to applying fixes and redeploying, even for systems with no documentation.
Frequently asked questions
We never installed Brotli. Does this concern us?
It may. Brotli is often built into Node.js, .NET, Python and Linux without users noticing. Start by finding out which platforms your systems run on.
Is an ordinary WordPress website affected?
Compressing pages before sending them is reported not to reach the bug. But operating-system packages managed by your hosting company may be affected, so check their notices too.
What about the browser on my computer?
Red Hat lists Firefox and Thunderbird on Linux as affected. Keep automatic updates on for browsers and email software, and always use the latest version.
How much will it cost?
It depends on how many platforms you use and how old they are. We look at your current setup first, then give you a quote with a clear overall plan.
Sources
- JPCERT/CC, alert on the Brotli out-of-bounds write vulnerability (CVE-2026-111497) (Japanese)
- JVN, JVNVU#97400824 (Japanese)
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (27 Oct 2026)
- Node.js, "Security Releases: Wednesday, October 21, 2026"
- Microsoft .NET, "Microsoft Security Advisory CVE-2026-111497"
- GitHub Advisory Database, GHSA-9v8h-qqgm-4m35 (Python brotli)
- Ubuntu, CVE-2026-111497
- Red Hat, CVE-2026-111497
Related articles
GitLab CVE-2026-97229 (CVSS 10): Exploited, Patch Now
Linux Kernel Fragnesia (CVE-2026-46300): Exploited, Patch Now
PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now
PHP Upgrade Cost: Moving From PHP 5 or 7 to PHP 8
Taking Over a Legacy System With No Documentation
Node.js Security Release, October 2026: What to Do
Java Vulnerabilities, October 2026: IPA Alert and Licence Changes
Securing Legacy Systems: Where to Start (2026 EOL Guide)
Superior Features of ChatGPT 4o (4 Omni)
What Is Digital Transformation? Definition, Roadmap and Examples
The Secret to Happiness!
What Is an IT Comtor? Role, Skills and How It Differs from a BrSE
