Do Son 
Cybersecurity firm Aikido Security recently published an urgent advisory regarding an expanding decompression flaw. Initially tracked as Node2Shell (CVE-2026-111497), the threat now jeopardizes numerous HTTP applications using Brotli. Consequently, researchers christened this broader attack surface the HTTP2Shell vulnerability. This issue does not introduce a novel CVE identifier. Instead, it reflects an unpatched weakness inside the underlying Brotli decompression engine. Therefore, security analysts coined the moniker to accelerate industry patching.
Assessing Decompression Risk Across Untrusted Payloads
Google originally engineered the Brotli format to compress web assets and API payloads efficiently. However, the critical flaw resides within the parsing logic of the Brotli decoder. Specifically, malformed compressed streams can trigger abnormal block switches during processing. This anomaly induces out-of-bounds memory writes inside the host application. Consequently, the flaw enables process crashes, sensitive data leaks, and arbitrary code execution.
Importantly, running an HTTP server does not automatically trigger the vulnerability. Instead, exploitation requires a vulnerable decoder and untrusted user input. If an application never unpacks untrusted Brotli data, the system remains secure. Therefore, exposure depends entirely on how applications handle compressed client payloads.
Runtimes Require Independent Security Updates
Software maintainers have begun rolling out essential updates across diverse runtimes. Specifically, Node.js issued patched versions across the 22.x, 24.x, and 26.x release lines. These maintenance releases correspond to versions 22.23.4, 24.22.1, and 26.12.1 respectively. Meanwhile, the Bun runtime addressed the parser defect in version 1.4.4.
Python developers must update the standard Brotli library to version 1.2.1. Alternatively, teams using the brotlicffi wrapper should upgrade to version 1.2.10. Furthermore, Google delivered upstream core fixes across versions 1.0.10, 1.1.1, and 1.2.1. Because these libraries operate independently, updating one runtime will not secure other installed components. Therefore, administrators must audit containers, application dependencies, and system packages separately. If patches remain unavailable, engineers should temporarily disable Brotli decompression.
Demonstrating Remote Code Execution in the Lab
Security researchers at Imperva successfully verified the exploit in laboratory environments. In their technical breakdown of Node2Shell from Brotli data to remote code execution, analysts demonstrated practical exploitation. Specifically, the team achieved arbitrary command execution on a Node.js 24.22.0 Linux ARM64 system.
The tests proved viable across both incoming request payloads and outgoing fetch responses. However, researchers noted that exploit reliability varied between attempts. Fortunately, testing on patched Node.js 24.22.1 builds confirmed that the exploit chain fails. Therefore, developers maintaining web infrastructure must update their Brotli dependencies immediately.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
