Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius impacts many libraries & apps utilizing HTTPs.

TL;DR

⚠️ Brotli is a broadly used compression library from Google. On Wednesday, October twenty first NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” whereby a Node.js course of that decompresses attacker-controlled Brotli knowledge will be made to leak reminiscence or run arbitrary code. On Thursday, Python disclosed that Python packages had been susceptible to CVE-2026-111497 as properly.

On Friday, October twenty third, it has turn out to be identified that this CVE impacts different main languages and repair functions utilizing HTTP, the place patches are usually not but totally accessible.

Check if you’re decoding Brotli as a dependency inside your libraries. Stay on guard for wider bulletins and be able to improve as quickly as potential. If there is no such thing as a patch accessible for a library or utility that could be affected, we advocate disabling Brotli decoding till patches turn out to be accessible.

Update 4:12PM PT:

 Patches can be found for libbrotli, Python, C++, NodeJS, bun, Envoy and extra coming. Apache and Nginx don’t decode brotli by default.

Update 4:15 PM PT: OpenAI shares that they discovered this vulnerability in February. While the basis trigger problem was fastened within the Brotli supply code on the time, it wasn’t identified that it gave rise to a safety vulnerability. OpenAI’s advisories here.
‍

What is Brotli?

Brotli is a lossless compression algorithm and knowledge format developed by Google. It’s a approach to make knowledge smaller for storage or sending over the web. Software then unpacks it to recuperate the unique knowledge. It’s broadly used for HTTP compression to compress net content material similar to HTML, CSS, and JavaScript.

What is CVE-2026-111497?

CVE-2026-111497 is an out-of-bounds write within the Google Brotli decoder affecting variations 1.0.3 by means of 1.2.0 on all platforms. This is similar Brotli decoder flaw behind Node2Shell introduced a pair days in the past. A distant, unauthenticated attacker can ship a crafted Brotli-compressed stream to deprave reminiscence, leak delicate knowledge, crash the method, or probably execute arbitrary code. It carries a CVSS v4.0 rating of 9.2 (Critical), and Node.js is affected by means of its bundled Brotli library.

A bug makes the Brotli decoder preserve accepting extra bytes when it ought to reject the info. Those bytes can overflow a small working buffer and injury this system’s reminiscence. An attacker can use that injury to manage what runs, similar to their very own code.

OpenAI found this in February reported it as unauthenticated distant code execution that works in each instructions, so a malicious shopper can take over an unpatched server and a malicious server can take over an unpatched shopper that accepts compressed responses.

The root trigger was fastened within the Brotli supply code in February, nevertheless it wasn’t acknowledged as a safety problem on the time and no launch shipped with the repair till now. That means each mission that bundles Brotli has to ship its personal replace. 

‍You’re uncovered if any setting has Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x put in, since HTTP purchasers similar to requests, httpx, and aiohttp load these packages mechanically once they’re current. Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild any container pictures that bundle them. As of October 23, advisory databases don’t map the CVE to both PyPI package deal, so pip-audit, Dependabot, and Safety gained’t flag susceptible variations but.

‍You can see what we’ve tracked right here in Aikido Intel. 

As for unaffected software program, Apache’s customary mod_brotli doesn’t decode Brotli

How to patch HTTP2Shell CVE-2026-111497

For CVE-2026-111497, replace the affected runtime or Brotli library:

• Node.js: improve to 22.23.4, 24.22.1, or 26.12.1, or a more recent supported launch within the corresponding launch line.
• Native Brotli / libbrotli: improve to 1.2.1 or later. For older launch traces, use patched 1.0.10 or 1.1.1.
• Python packages: improve Brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later, wherever put in.
• curl / libcurl: replace its Brotli dependency to 1.2.1, a patched older launch, or the seller’s security-fixed package deal. Bundled or statically linked copies require an up to date utility construct.
• Bun: improve to 1.4.4 or later. Rebuild compiled executables that bundle Bun.
• Envoy: improve to 1.40.0, 1.39.3, 1.38.6, or 1.37.8, or a more recent launch in a supported department. 1.36.12 additionally contains the repair, however the 1.36 department is unsupported.
• Istio: the repair is included in 1.29.9, 1.30.6, and 1.31.2. Use a more recent supported launch within the corresponding line; the 1.29 department is finish of life.
• Operating-system packages: set up the seller’s safety replace. Vendors might backport the repair with out altering the upstream model quantity.
• Other HTTP servers, reverse proxies, API gateways, and HTTP purchasers: replace the affected runtime or Brotli library they use. Where Brotli is bundled into the product, set up the product vendor’s launch that explicitly addresses this CVE. For managed companies, verify remediation with the supplier.

Update dependency locks, rebuild affected functions and container pictures, redeploy, and restart companies. Verify that working workloads use the patched parts.

‍

What to do if you cannot improve but

These workarounds scale back publicity when you put together the improve:

• Python functions: the place Brotli assist is optionally available, uninstall each Brotli and brotlicffi from affected environments. Remove dependency extras similar to httpx[brotli] and every other necessities that might reinstall them, then regenerate dependency locks and rebuild/restart workloads. HTTPX, Requests, and urllib3 retain gzip and deflate assist with out these optionally available packages. However, a server that sends Brotli anyway might produce an unreadable response or an utility error; automated fallback will not be assured.
  • Uninstalling each Python packages and restarting workloads removes the decoding paths supplied by these packages for incoming and outgoing knowledge. It doesn’t take away separate Brotli decoders bundled into different runtimes, libraries, or merchandise.
• Incoming HTTP requests: reject requests whose Content-Encoding contains br on the reverse proxy, load balancer, or utility middleware, earlier than any susceptible decoder processes the physique. Match br case-insensitively, together with inside lists of encodings. 
• Outbound HTTP requests: take away br from Accept-Encoding. Also disable Brotli response decoding or reject responses whose Content-Encoding contains br earlier than decoding begins. Ensure this test happens earlier than automated physique processing; checking after the shopper has downloaded and decoded the response is simply too late.

Changing Accept-Encoding alone is inadequate: a malicious server can ship a Brotli response no matter what the shopper advertises, and urllib3 selects its decoder from the response’s Content-Encoding header.

Keep these controls in place till affected parts are patched and verified. Review protection as distributors verify extra affected parts or assault paths.

How Aikido helps with CVE-2026-111497

Aikido flags susceptible variations of Brotli and brotlicffi in your repositories, container images, and dependencies, together with once they arrive as transitive dependencies. Your dashboard reveals which companies nonetheless run a susceptible model, so you may improve those that decision outdoors servers or settle for compressed request our bodies first. 

Once you’ve got upgraded, Aikido checks if the discovering is gone.

The timeline

Brotli is a broadly used compression library from Google. On Wednesday, October twenty second NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” whereby a Node.js course of that decompresses attacker-controlled Brotli knowledge will be made to leak reminiscence or run arbitrary code. Users had been uncovered if their app or a library decompresses unhealthy Brotli knowledge (e.g. the built-in fetch(), body-parser).

The subsequent day, Python launched a safety replace that patches the identical flaw; Python packages had been additionally susceptible to CVE-2026-111497. Brotli flaw might have an effect on much more languages and repair functions, given how broadly built-in the library is downstream. It turns out OpenAI had found this back in February.

Techincal particulars of CVE-2026-111497

The flaw sits in DecodeBlockTypeAndLength(), which handles block switches, the factors the place a Brotli stream modifications which Huffman tree it makes use of. In susceptible variations the perform returns a plain boolean, and BROTLI_FALSE can imply both “this stream is malformed” or “I would like extra enter.” Callers cannot inform the 2 aside, and on the quick path the decoder discards the return worth totally.

A crafted stream can declare a single block kind after which exhaust that block’s size, which forces a swap that may’t succeed. The decoder then both stories that it wants extra enter for a stream that is full, or retains decoding with the block state it already had. That second path results in the out-of-bounds write.

The upstream repair, google/brotli commit 0ed4268, makes the perform return an error code and provides a brand new error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17). Decoding now stops on a format error on each the protected and quick paths. OSM diffed the Brotli 1.2.0 and 1.2.1 supply distributions and located that 1.2.1 differs solely within the model bump and the decoder modifications from that commit.

‍

‍

Brotli vulnerabilities in Python libraries (CVE-2026-111497)

The Brotli flaw behind Node2Shell (CVE-2026-111497)  impacts Python. Two PyPI packages, Brotli and brotlicffi, compile the identical susceptible Brotli decoder that Node.js bundles. An official advisory was posted on GitHub. Brotli has 82.8 million downloads per thirty days.

You’re affected if any Python setting you run has Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x, put in. Popular HTTP purchasers similar to requests and httpx load these packages mechanically once they’re current. Some packages mechanically set up Brotli as a dependency similar to Scrapy, whereas others require express point out of it. An attacker can attain the susceptible decoder by sending a malicious Brotli response to a request your app makes, or by sending your app a request physique compressed with Brotli. That means an app will be uncovered with out importing Brotli anyplace in its personal code. It’s a well-liked transitive dependency, so test your methods.

To repair it, improve to the patched releases:

• Brotli -> 1.2.1
• brotlicffi -> 1.2.1.0

The launch notes for each fastened variations do not point out the CVE. As of October 23, advisory databases do not map it to both PyPI package deal but, so pip-audit, Dependabot, and Safety will not flag these variations.

Who is affected by CVE-2026-111497 in Python?

You’re affected if any of your Python environments have considered one of these packages put in:

Your code doesn’t must import both package deal. These HTTP purchasers promote Accept-Encoding: br and decode Brotli responses mechanically:

• urllib3 (and subsequently requests) when Brotli or brotlicffi is put in
• httpx with the brotli further
• aiohttp when Brotli is put in
• Scrapy, and something constructed on the purchasers above

Attacker knowledge can attain the decoder by means of two routes:

• Outbound requests. Your app fetches a Brotli response from a server an attacker controls, similar to by means of a webhook supply, URL preview, crawler or “fetch this URL” characteristic.
• Inbound requests. Your framework or middleware decodes a request physique despatched with Content-Encoding: br, which is the Python equal of the Express 5 case in Node.js.

How to repair CVE-2026-111497 in Python

The repair is a package deal improve, and it takes 4 steps:

1. Upgrade whichever package deal you have got put in with pip set up -U “Brotli>=1.2.1” or pip set up -U “brotlicffi>=1.2.1.0”. If you utilize a lockfile with Poetry, uv, or pip-tools, replace the constraint and regenerate the lockfile.
2. Rebuild your container pictures and any wheels that bundle both package deal. An picture constructed on a susceptible model stays susceptible till you rebuild it.
3. Check each setting you run, together with laptops, CI runners, servers and containers. Many initiatives pull in Brotli by means of an HTTP shopper further, so take a look at your full resolved dependency tree.
4. Rely on a handbook test for now. pip-audit, Dependabot and Safety will not report this till the advisory databases map the CVE to the PyPI packages.

If your Python Brotli bindings got here from a Linux distribution package deal as an alternative of PyPI, the repair comes by means of your distribution, so test its safety advisory as properly.

What is the Python Brotli vulnerability (CVE-2026-111497)?

Python Brotli vulnerability refers to CVE-2026-111497, the Brotli decoder flaw often known as Node2Shell, because it impacts Python packages on PyPI. The CVE report pairs CWE-252 (unchecked return worth) with CWE-787 (out-of-bounds write).

How severe is CVE-2026-111497 for Python, and is it being exploited?

The CVE report offers the flaw a CVSS 4.0 rating of 9.2, and Node.js charges it excessive severity. OSM constructed Brotli 1.2.0 and 1.2.1 with AddressSanitizer and ran a crafted stream by means of each. Version 1.2.0 consumed all the roughly 23 MB stream and stored reporting that it wanted extra enter, whether or not the stream arrived in a single piece or in chunks as small as one byte. Version 1.2.1 rejected the stream with error -17 each time.

OSM did not pursue reminiscence corruption or code execution within the Python extension. The decoder code is similar code that researchers exploited in opposition to an unmodified Node.js 24.22.0 construct, as Imperva and others reported. For Node.js, The Hacker News reported no exploitation within the wild as of October 22.

Treat it as pressing anyway. The bug is a memory-safety flaw in a part that handles untrusted community enter, and the repair is a routine model bump. Services that decision outdoors servers or settle for compressed request our bodies ought to go first.

How to test in case your Python app is uncovered

1. Check put in variations with pip present Brotli brotlicffi in every setting, and with docker run –rm pip present Brotli brotlicffi for every container picture.
2. Find what pulls the packages in. Run pipdeptree -r -p Brotli to see which dependencies require it, and search your lockfiles with grep -i brotli poetry.lock uv.lock necessities*.txt.
3. List the outbound HTTP calls that go to servers you do not management, and any endpoints that decode Content-Encoding: br request our bodies.
4. Upgrade the companies that match step 3 first, then the remaining.

If you are reproducing the bug from Python, brotli.decompress() raises a generic brotli.error: decoder failed for any error, so you may’t see which error code fired. A Decompressor() fed the crafted stream incrementally won’t ever end on 1.2.0.

FAQ

‍Which variations repair CVE-2026-111497 in Python?

Brotli 1.2.1 and brotlicffi 1.2.1.0, together with any newer releases.

Do I have to import Brotli in my code to be affected?

An put in package deal is sufficient. urllib3, requests, httpx and aiohttp use Brotli or brotlicffi mechanically when both is current and decode Brotli responses from any server your app calls.

Will pip-audit or Dependabot flag this?

Not but. As of October 23, the CVE report, OSV and the GitHub Advisory Database do not record both PyPI package deal. OSM is submitting PYSEC entries and a PyPI package deal mapping for the GitHub advisory in order that tooling picks this up.

Is there a workaround?

Uninstalling Brotli and brotlicffi removes the susceptible decoder, and HTTP purchasers fall again to gzip and deflate. Rejecting Brotli-encoded requests on the edge reduces inbound publicity, nevertheless it does not shield in opposition to Brotli responses your app fetches.