Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

The exploit, dubbed "Node2Shell," affects numerous HTTP libraries and applications due to a vulnerability in the Google Brotli decoder. This bug, CVE-2026-111497, affects Brotli versions 1.0.3 to 1.2.0 on all platforms. It enables an attacker to send a crafted Brotli-compressed stream, corrupt memory, leak sensitive data, crash the process, or execute arbitrary code.

OpenAI discovered this flaw in February and reported it as an authenticated remote code execution issue. The vulnerability stems from the Brotli decoder keeping accepting bytes when it should reject them, causing overflow and memory damage. The root cause was corrected in Brotli source code in February, but it wasn't recognized as a security issue and no release contained the fix until now.

Projects bundling Brotli 1.2.0 or earlier and brotlicffi 1.2.0.x need to ship their own update. Most HTTP clients, like requests, httpx, and aiohttp, automatically load these packages when present. To mitigate the risk, upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild containers. Until patched, workarounds include monitoring for vulnerable versions and upgrading affected services.