Brotli2Shell (CVE-2026-111497)

Brotli2Shell (also called Node2Shell, HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in Google's Brotli C decoder, versions 1.0.3 to 1.2.0. If an application decompresses Brotli data an attacker controls, the decoder can write past its memory. The result ranges from a crash to leaked memory to, in some setups, remote code execution. It became public when Node.js disclosed it on 21 October 2026; the upstream fix had been committed in February without a release or advisory.

The decoder is bundled into far more than Node.js: .NET, Bun, Envoy and Istio, Python's Brotli and brotlicffi packages (which urllib3, requests, httpx and aiohttp use automatically when installed), and PHP for Windows through cURL when automatic decompression is turned on. Attacker data can arrive three ways: compressed requests you receive, compressed responses you fetch, and files you process. JFrog reproduced crashes in ClickHouse, FFmpeg (via JPEG XL) and .NET.

CISA added it to KEV on 27 October 2026, but read the evidence carefully: ELLIO's sensors caught one real exploitation attempt against Node.js 24.22.0, but the attacker's chain scored zero hits in 50 test runs. ELLIO did get shells in its own lab on stock Node.js builds, so a working exploit is possible. Patch every copy (Node.js 26.12.1, 24.22.1 or 22.23.4, Brotli 1.0.10/1.1.1/1.2.1 and vendor updates), then restart services so the old library is no longer loaded.