HTTP/2Shell (CVE-2026-111497): Brotli Risk and Fixes

HTTP/2Shell is one of the names used for CVE-2026-111497, a vulnerability in the Brotli decoder. Despite the name, the core issue is not the HTTP/2 protocol itself. The bug is in code that decompresses Brotli data. An application may be at risk when it accepts attacker-controlled Brotli streams and decompresses them with an affected decoder.

The issue is also called Node2Shell or Broccoli2Shell. These names refer to the same Brotli decoder vulnerability, not separate flaws. It is distinct from PHP2Shell: PHP2Shell concerns two bugs in the PHP runtime, while CVE-2026-111497 is in a compression library used by multiple runtimes and products.

What happens?

Brotli is a lossless compression algorithm widely used on the web. Browsers, servers, proxies, runtimes, and client libraries may use it to reduce data size. When a decoder processes malformed input, the affected versions can write outside a memory boundary. Possible consequences include a crash, disclosure of some process memory, memory corruption, and under certain conditions code execution.

Node.js explains that an invalid block switch could be interpreted as a request for more input instead of a format error. The streaming decoder then continued appending data to a small internal buffer. This implementation detail helps explain why the decoder must be updated, but it does not mean every program that merely has Node.js installed is automatically exploitable.

When is an application exposed?

The key question is whether an affected component actually decompresses Brotli data that an outside party can influence. A server may accept compressed request bodies, an HTTP client may automatically decompress responses from another server, or a proxy may enable Brotli decompression. By contrast, using Brotli only to compress outgoing responses does not by itself prove that the vulnerable decoder path can be triggered.

Exposure conditions vary by ecosystem. Node.js identifies applications that decompress attacker-controlled Brotli data through node:zlib as a path to review. The .NET advisory says a runtime package alone does not automatically expose an application: exposure requires Brotli request or response decompression, or decoder APIs processing untrusted input. Envoy is affected in certain versions when the Brotli decompressor is configured. For PHP, inspect the Brotli extension and libraries actually in use; this issue is separate from the PHP core patches for PHP2Shell.

Components and versions to inventory

Affected upstream Google Brotli versions range from 1.0.3 through 1.2.0. Fixed upstream releases include 1.0.10, 1.1.1, and 1.2.1. However, applications may bundle or statically link their own copy. Updating the operating system package may not update the copy inside Node.js, a container image, a NativeAOT executable, a proxy, or a Python dependency.

• Node.js: Initial security releases for affected lines included 22.23.4, 24.22.1, and 26.12.1. Use the latest security release available for a supported Node.js line, not just the initial fixed version.
• Python: The PyPI Brotli package is fixed in 1.2.1 and brotlicffi in 1.2.1.0. Optional dependencies for HTTP clients may enable Brotli support.
• Envoy: The project advisory lists fixes in 1.40.0, 1.39.3, 1.38.6, 1.37.8, and 1.36.12.
• .NET: Fixes are available through vendor runtime and SDK updates. Check Microsoft's advisory for the versions matching your major release, NativeAOT, or self-contained applications.
• PHP and application images: Check the Brotli extension, linked library, and runtime or image update from your provider. A PHP core patch for PHP2Shell does not automatically prove that every separately bundled Brotli component is fixed.

How to check a project and server

1. List services. Inventory Node.js, Python, .NET, PHP, Envoy, proxies, container images, serverless functions, build agents, and other applications that process Brotli content.
2. Check direct and transitive dependencies. Review lockfiles such as package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, .NET project files, and image SBOMs. Look for Brotli packages and HTTP clients that may enable decompression.
3. Confirm the decode path. Determine whether the service decompresses request bodies, responses from external hosts, queue messages, uploads, or stored content. Review proxy and middleware configuration rather than relying only on dependency names.
4. Match the vendor advisory. Vendors may bundle a fix or backport it. Verify the advisory for the exact product and package installed.
5. Update and rebuild. Upgrade the runtime or package, rebuild images and self-contained applications, and redeploy. Restart processes so they do not keep an old library loaded.
6. Verify deployment. Check runtime and dependency versions, confirm every replica is updated, test normal compression workflows, and monitor error logs.

Temporary mitigations

If an update cannot be installed immediately, the safest temporary option is to disable paths that decompress Brotli data from untrusted sources, when operationally possible. Rejecting Brotli-compressed request bodies at a proxy or load balancer may help with that inbound path, but it does not protect an application that downloads and decompresses Brotli responses from another server. Disabling outgoing response compression alone should not be assumed to disable the decoder.

For services that must remain online, restrict data sources, isolate the process appropriately, reduce privileges, and increase logging and monitoring. These steps can reduce exposure or impact; they do not replace a decoder update. Test changes in staging because some clients or integrations may rely on Brotli.

Has this been exploited?

CVE-2026-111497 has been added to CISA's Known Exploited Vulnerabilities catalog. Treat inventory and patching as a priority, especially where services process compressed data from the internet. Reports of exploitation do not mean every system that contains Brotli has been compromised. After patching, review logs for decoder crashes, unexpected restarts, unusual requests, or process behavior that differs from the baseline.

Frequently asked questions

Should I disable HTTP/2?

The name alone is not a reason to disable HTTP/2 across the board. Focus on Brotli components that decompress input and follow product-specific vendor guidance.

Is every site using Brotli vulnerable?

Not automatically. An affected decoder and a path that processes attacker-controlled Brotli data must both be present. Configuration and how the library is bundled determine exposure.

Is updating the system Brotli library enough?

Not always. Software may bundle a static copy. Update runtimes, dependencies, container images, executables, or vendor products that include the decoder.

Is this the same as PHP2Shell?

No. PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619 in the PHP core. HTTP/2Shell or Node2Shell refers to CVE-2026-111497 in the Brotli decoder.

Primary references: Node.js security advisory, GitHub Advisory for Brotli and Python, Envoy advisory, and Google Brotli releases.