Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Node2Shell has evolved into HTTP2Shell, affecting numerous HTTP libraries and applications due to a critical out-of-bounds write vulnerability in the Google Brotli decoder. This flaw, CVE-2026-111497, impacts versions 1.0.3 through 1.2.0 across all platforms. An attacker can exploit this by sending a specially crafted Brotli-compressed stream, leading to memory corruption, sensitive data leakage, process crashes, or potential arbitrary code execution. The vulnerability carries a CVSS v4.0 score of 9.2, classified as critical.

The Brotli algorithm, developed by Google, is a lossless compression method used for data storage and transmission over the internet, commonly employed in web content such as HTML, CSS, and JavaScript. The root cause of the issue was initially identified in February but was not recognized as a security concern until recently. The vulnerability affects the Brotli decoder in Node.js, Python packages Brotli and brotlicffi, and other compatible software.

Although the upstream fix was implemented in February, it took time for vendors to release updated versions. As a result, any software utilizing Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x is at risk. Popular HTTP clients like requests, httpx, and aiohttp automatically load these packages, leaving them vulnerable unless updated. It is crucial to upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild affected container images to mitigate the risk.

Despite the availability of updated libraries, some advisory databases still fail to map the CVE to PyPI packages, making it challenging for automated tools to identify vulnerable versions. Users are advised to manually check their dependencies, rebuild their applications, and redeploy services to ensure they are protected against this vulnerability. Continuous monitoring and verification of patched components are essential to maintain the security of affected systems.