Node.js Vulnerability 2026: HTTP2Shell (Node2Shell) Brotli Flaw and How to Patch

Last updated: October 29, 2026. By Veer. Facts checked against the Node.js security advisory, the Brotli 1.2.1 release, the Bun advisory, Debian, Ubuntu and Red Hat trackers, CISA’s KEV catalog, and reporting by The Hacker News, Aikido, Tanium, Brandefense and Mallory.

What is the Node.js vulnerability (HTTP2Shell / Node2Shell)?

It’s a memory-corruption bug in the Brotli decoder that Node.js bundles, and it can let an attacker who sends crafted compressed data crash your app, read its memory or potentially run code. Brotli is Google’s compression format, and it’s one of the main ways web servers shrink HTML, CSS, JavaScript and API responses (Content-Encoding: br).

The Node.js advisory explains the root cause in one line: “An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer.” In plain English, the decoder hits a point in the stream that should be impossible, wrongly decides it just needs more data, and keeps writing past the end of a tiny buffer.

Key facts you can quote:

• CVE: CVE-2026-111497 (CWE-787 out-of-bounds write; Aikido also lists CWE-252, unchecked return value).
• Affected code: Google Brotli 1.0.3 through 1.2.0. Fixed upstream in 1.0.10, 1.1.1 and 1.2.1, all published on GitHub on October 21, 2026.
• Severity: 9.2 Critical on CVSS v4.0 in Google’s CVE record (per Tanium and Aikido). Node.js rates it High; Red Hat rates it Important (8.1 on CVSS 3.1), citing the need for a malformed stream and platform hardening.
• Who found it: Node.js credits OpenAI Codex Security (Khai Tran and Sylvie Mayer).
• The awkward part: the fix was committed to Google’s Brotli repository on February 27, 2026 (commit 0ed4268) with no security note and no release, so nobody shipped it for eight months, according to Tanium’s timeline.

Why two names?

Node2Shell and HTTP2Shell are the same bug, one CVE. It was called Node2Shell first because Node.js shipped the first fix on October 21. Aikido renamed it HTTP2Shell on October 23 after showing Python HTTP clients were exposed too, and Bun used the new name for its advisory on October 24. Despite the name, it has nothing to do with the HTTP/2 protocol; the bug is in the Brotli decoder file c/dec/decode.c, as Brandefense points out.

Which versions are affected, and which are fixed?

Anything that decompresses Brotli with a vulnerable copy of Google’s decoder is in scope. Here are the fixed versions published by each project as of October 25, 2026.

A Node.js timing note for US and UK teams planning upgrades: per the official Node.js release schedule, Node.js 24 moved to maintenance on October 20, 2026, Node.js 26 becomes LTS on October 28, 2026, and Node.js 20 reached end of life on April 30, 2026. If you’re still on 20, this is the vulnerability that should force the move.

Where Linux distributions stand

Debian and Alpine have fixed packages; Ubuntu and Red Hat Enterprise Linux did not as of the latest tracker updates. Distributions often backport fixes without changing the upstream version number, so compare the full package release, not just “1.0.9” or “1.1.0”.

Sources: Debian security tracker and Ubuntu CVE page, both checked October 25; Alpine, SUSE and Red Hat status as compiled by Brandefense on October 24. On Debian, the system brotli package is the one that fixes Node.js, because Debian’s nodejs links the system library.

Am I affected?

You’re exposed if something you run decompresses Brotli data that someone else controls, in either direction. No login is needed, but the attacker’s data has to reach the decoder.

• Inbound (server side): your app decodes a request body sent with Content-Encoding: br. Express 5’s body parsers (express.json(), urlencoded(), text(), raw()) decode Brotli bodies, The Hacker News reports; Express 4 rejects Brotli bodies, per Tanium. A plain Node.js http server doesn’t decode a Brotli body just by receiving it.
• Outbound (client side): your app fetches a Brotli response from a server an attacker controls: webhooks, link previews, crawlers, RSS readers, “import from URL” features and AI agent tools. Node.js fetch() and Bun fetch decode Brotli automatically, and Python’s urllib3 (so requests), httpx and aiohttp do the same whenever Brotli or brotlicffi is installed, according to Aikido.
• Python with no import brotli anywhere: still exposed if the package is installed, because HTTP clients load it on their own. Scrapy installs it for you. Aikido puts Brotli’s downloads at 82.8 million a month.

Probably not affected: Apache’s mod_brotli and nginx, which compress responses but don’t decode Brotli by default (Aikido, Mallory). Ordinary visitors browsing your website aren’t at risk from this bug on your server; it’s software that decodes hostile Brotli data that matters.

Don’t forget bundled copies. Tanium reports that VS Code Server 1.143.1 (bundling Node.js 24.22.1) is fixed, while Kibana had no fix yet as of October 24. Electron desktop apps, single-executable apps and container images carry their own Node.js and stay vulnerable until their vendor or you rebuild them.

Is HTTP2Shell being exploited?

Yes, attempts have been seen. CISA added CVE-2026-111497 to its exploited list on October 27, and honeypots logged attempts on October 26 and 27, though no successful compromise had been confirmed as of October 28. Here’s what each source says:

• CISA: CVE-2026-111497 was added to the Known Exploited Vulnerabilities catalog on October 27, 2026, due November 10 (catalog version 2026.10.28, checked October 29). It was not listed as of October 25.
• Imperva (October 22): demonstrated code execution on the official, unmodified Node.js 24.22.0 image for Linux arm64, through both fetch() and Express 5 request parsing. It took several attempts, and 24.22.1 rejected the same data (The Hacker News).
• OtterSec (October 24): reported a privately held, AI-written exploit that succeeded 50 times out of 50 against the official Node.js 24.22.0 image on x86_64 with ASLR on, per Mallory. It hasn’t been published.
• Public code: Mallory tracks 35 GitHub repositories for the CVE (Brandefense counted 38). None runs code on a stock Node.js build, but several can hang or crash a vulnerable service with a few dozen bytes. Treat remote denial of service as available to anyone.
• The dissent: one researcher argues the bad write can’t lead to code execution and the real impact is a crash. Two independent teams report code execution on official builds, so don’t bank on that argument.

Scam warning: a crypto token called “$HTTP2SHELL” started circulating on X within about 40 minutes of the name spreading, and some “scanner” repositories reuse old, unrelated projects named http2shell, Brandefense reports. Take fixes only from the vendor pages linked above, and don’t run random exploit or checker code outside an isolated lab.

This is the second “2Shell” bug in a week: the PHP vulnerability (PHP2Shell) hit PHP servers on October 21 and is already seeing mass exploitation attempts. Earlier in the month, the Plex vulnerability went from public proof of concept to CISA’s exploited list within days, which is a good reason not to wait on this one.

How to fix the Node.js vulnerability: step by step

Update every copy of the decoder, then restart or rebuild whatever was running the old code. A patched package on disk does nothing for a process that already loaded the vulnerable version.

1. Check your Node.js version. Run node -v. You need v22.23.4, v24.22.1 or v26.12.1 or later on that line. Don’t rely on process.versions.brotli: Tanium notes it still reports 1.1.0 or 1.2.0 on fixed releases because the fix was cherry-picked.
2. Update Node.js. Download from nodejs.org, or use your version manager: nvm install 24.22.1 (or fnm install, volta install node@24.22.1). On Homebrew, run brew upgrade node. Then repeat on every CI runner and build agent.
3. Rebuild container images. Pull a fresh node:24.22.1 (or 22.23.4 / 26.12.1) base image and rebuild; Tanium warns that cached base layers may still be old. Redeploy and confirm with docker run --rm IMAGE node -v.
4. Fix Python environments. Run pip show Brotli brotlicffi in every virtualenv, container and CI image. Upgrade with pip install -U "Brotli>=1.2.1" or pip install -U "brotlicffi>=1.2.1.0", then regenerate lockfiles (Poetry, uv, pip-tools). Use pipdeptree -r -p Brotli to see what pulls it in. Aikido warned that as of October 23, pip-audit, Dependabot and Safety didn’t flag the vulnerable PyPI versions yet, so check by hand.
5. Update Bun to 1.4.4 with bun upgrade, and rebuild any bun build --compile executables.
6. Patch Linux system packages (libbrotli1/brotli) where your distribution has a fix: sudo apt update && sudo apt install --only-upgrade libbrotli1 on Debian, apk upgrade brotli on Alpine. Restart services afterward. On Ubuntu and RHEL, watch the vendor page daily.
7. Update proxies: Envoy and Istio to the fixed versions in the table above.
8. Move off Node.js 20 or older. There is no fix coming. Plan the jump to 22 or 24, or to 26 once it becomes LTS on October 28. If you also track Windows lifecycles, our Windows end-of-support calendar covers those dates.

If you can’t patch today

These cut exposure but don’t replace the update (Aikido, Tanium, Bun):

Stripping br from your Accept-Encoding header isn’t enough on its own: a malicious server can send Brotli anyway, and urllib3 picks its decoder from the response header. Vercel added WAF rules for hosted projects on October 21, but those rules don’t cover Brotli responses your own server-side fetch() calls decode (The Hacker News).

What to patch first

Start with anything that decodes Brotli from strangers. Based on the guidance from Brandefense, Mallory and Tanium, a sensible order is:

1. Internet-facing Express 5 apps and Envoy gateways with the Brotli decompressor on.
2. Fetchers: crawlers, link previews, webhook senders, RSS readers, scrapers and AI agent sandboxes that browse arbitrary URLs. If you run AI agents with web access, our AI agent security checklist covers the wider risks.
3. Build servers and developer laptops that run Node.js, Bun or Python and pull third-party content.
4. End-of-life Node.js (20 and older), which won’t get a fix at all.
5. Linux hosts, as each distribution ships its package.

After patching, look back for warning signs: Node.js, Bun or Python processes that crashed with SIGSEGV or kept restarting since October 21, node spawning a shell or download tool, and spikes of inbound requests carrying Content-Encoding: br. Each failed exploit attempt usually crashes the process, so a service stuck in a restart loop deserves a look.

HTTP2Shell timeline

Sources: Tanium, Mallory, Brandefense, GitHub releases.

The other fixes in the same Node.js update

The October 21 Node.js release fixes nine other CVEs, so updating is worth it even if you never touch Brotli. Three more are rated High in the advisory:

The release also updates c-ares, OpenSSL (24.x, 22.x), SQLite (22.x), Undici and the bundled CA list after the eMudhra intermediate CA compromise.

What we don’t know yet

• Whether real attacks have started. None reported so far; that can change within hours once a reliable exploit goes public, as it did with PHP2Shell.
• When Ubuntu and Red Hat ship fixes. Both trackers showed no fixed brotli or nodejs package at last check.
• How many other products bundle Brotli. Bug trackers cited by Mallory name .NET, DuckDB, ClickHouse, libjxl, MuPDF, archive tools and UEFI tooling, and most had no fixed release as of October 24.

We’ll update this page as vendors ship fixes or exploitation status changes.

FAQ

What is the Node.js vulnerability in October 2026?

It’s CVE-2026-111497, called Node2Shell or HTTP2Shell: an out-of-bounds write in the Brotli decoder bundled with Node.js. Crafted Brotli-compressed data can crash a Node.js app, leak memory or potentially run code. Node.js fixed it on October 21, 2026 in versions 22.23.4, 24.22.1 and 26.12.1.

Is HTTP2Shell the same as Node2Shell?

Yes. Both names refer to the same CVE, CVE-2026-111497. “Node2Shell” came first because Node.js shipped the first fix; “HTTP2Shell” spread after Aikido showed Python HTTP clients and other software using Brotli were affected too. It is not a flaw in the HTTP/2 protocol.

Which Node.js version fixes HTTP2Shell?

Node.js 22.23.4, 24.22.1 and 26.12.1, or any later release on those lines. Node.js 20 and older, 23 and 25 are end of life and will not get a fix, so move to a supported line.

Is my Python app affected by HTTP2Shell?

Yes, if any environment has Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x installed, even if your code never imports it, because requests, httpx and aiohttp decode Brotli automatically when the package is present. Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild your images.

Is HTTP2Shell being exploited in the wild?

Attempts, yes. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, and Previdian and ELLIO logged exploitation attempts on October 26 and 27. No successful compromise had been confirmed as of October 28, but failed attempts can crash unpatched services, so patch now.

What if I can’t update Node.js right away?

Reject requests with Content-Encoding: br at your proxy or WAF, set inflate: false on Express 5 body parsers, and limit which servers your app fetches from. These only reduce exposure; the update is the only real fix, and WAF rules don’t cover Brotli responses your own code fetches.

Sources

• Node.js: October 21, 2026 security releases and release schedule
• Google: Brotli v1.2.1 release
• Bun: advisory GHSA-663w-cv8g-jj2p
• Envoy: advisory GHSA-3wvj-j6qm-62mr; Istio: ISTIO-SECURITY-2026-007
• Debian security tracker, Ubuntu CVE page, Red Hat CVE page
• CISA: Known Exploited Vulnerabilities catalog
• SecurityWeek: CISA warns of Node2Shell exploitation as honeypots log attack attempts (October 28, 2026)
• The Hacker News: Researchers demonstrate Node2Shell RCE exploit
• Aikido: Node2Shell evolves to HTTP2Shell
• Tanium: HTTP2Shell: find and fix vulnerable Brotli copies
• Brandefense: HTTP2Shell fixed versions by stack
• Mallory: Node2Shell / HTTP2Shell: am I affected?