node2shell / HTTP2Shell (CVE-2026-111497): What to patch and how to check if you’re exposed

Update, October 30, 2026: Added how to check if you’re exposed and answers to common questions. Some coverage calls this bug HTTP2Shell or Broccoli2Shell. It is the same CVE. On October 27, CISA added it to the Known Exploited Vulnerabilities catalog after confirming exploitation in the wild.

CVE-2026-111497, also called node2shell, HTTP2Shell or Broccoli2Shell, is an out-of-bounds write in the Brotli decoder that ships inside Node.js. A crafted Brotli stream can crash the process, leak memory or run code. The fix is Node.js 22.23.4, 24.22.1 or 26.12.1 and Bun 1.4.4, and the services to patch first are the ones that decompress Brotli data they do not control.

Update, October 26, 2026: .NET

On October 25 Microsoft released out-of-band .NET updates for CVE-2026-111497 in the copy of the Brotli decoder that .NET uses. Microsoft rates it Critical for .NET and Visual Studio and Important for PowerShell, with a CVSS 3.1 score of 8.1 (the 9.2 above is the CVSS 4.0 score). The issue is publicly disclosed. Microsoft reports no exploitation as of October 25 and assesses exploitation as more likely.

.NET Framework is not affected.

Brotli decompression is off by default in .NET and ASP.NET Core. An application is exposed only if it, or a library it uses, turns on one of these:

• ASP.NET Core request decompression (AddRequestDecompression and UseRequestDecompression)
• HttpClient automatic response decompression that includes Brotli (AutomaticDecompression set to Brotli or All)
• Brotli decompression through the System.IO.Compression APIs (BrotliStream with CompressionMode.Decompress or BrotliDecoder)

What Cycode added. The node2shell items on the Threat Intelligence dashboard now also list Dockerfiles that pin a .NET 8, 9 or 10 aspnet, runtime or sdk image below the fixed versions and container images with a .NET 8, 9 or 10 runtime below 8.0.33, 9.0.22 or 10.0.14. Floating tags such as aspnet:8.0 are not listed from Dockerfiles, because a rebuild picks up the fix; images already built from them show up through the image check. Because the exposure is opt-in, a listed .NET image tells you which applications to check for the settings above.

What to do.

• Update the .NET runtime to 8.0.33, 9.0.22 or 10.0.14 and the SDK to a fixed version in the table, then restart the applications that run on it.
• Rebuild and republish self-contained applications. They carry their own runtime, which a .NET update on the host does not change.
• Rebuild container images with the updated base image (docker build –pull). Images built from tags such as aspnet:8.0 before October 25 keep the old runtime until they are rebuilt.
• Update PowerShell and Visual Studio to the versions in the table.
• Search your .NET code and dependencies for the decompression settings above to find applications that are exposed.

What Happened

The bug is in Google’s Brotli C library, which Node.js and Bun bundle. A stream that declares a single block type and then switches blocks was not rejected, so decoding continued in an invalid state and wrote past a buffer (CWE-787, CWE-252). Khai Tran and Sylvie Mayer of OpenAI Codex Security found and reported it to Node.js. Google, the CNA, scored it 9.2 Critical under CVSS 4.0, and Node.js rates it High. The Node.js advisory states that the bug permits remote code execution. Code execution has been demonstrated publicly on the official Node.js 24.22.0 arm64 image, and a public proof of concept exists. On October 27, CISA added the CVE to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild, and gave US federal agencies until November 10 to patch.

Who Is Exposed

Exposure takes two conditions. The first is a Node.js or Bun runtime below the fixed version, whether it sits in a container base image, on a build host or on a server. The bug is in the runtime, not in an npm package; the npm package named brotli is not the vulnerable component.

The second is a path for attacker data to reach the decoder. The Node.js advisory frames it as Brotli data that an application decompresses with node:zlib: zlib.brotliDecompress, brotliDecompressSync, createBrotliDecompress, or a library that calls them for you. A bare http server does not decode Brotli request bodies.

In Express 5 and body-parser 2.x, json(), urlencoded(), text() and raw() all decode Brotli request bodies. So do the Koa body parsers (koa-bodyparser, @koa/bodyparser, koa-body, co-body) and @fastify/compress with request decompression. The built-in fetch() decodes Brotli responses, so code that fetches user-supplied URLs is also exposed. Express 4 and body-parser 1.x do not decode Brotli request bodies.

Python is affected too. GitHub advisory GHSA-9v8h-qqgm-4m35 covers the PyPI packages brotli and brotlicffi, which bundle the same decoder.

Affected and Fixed Versions

Node.js lists no workaround, so upgrading is the fix. End-of-life Node.js lines get no patch.

How to Check If You’re Exposed

Exposure takes two things: a vulnerable runtime or library, and a path for attacker data to reach the Brotli decoder. Check both.

1. Check the runtime version. Run node -v and bun --version on servers, build hosts and inside running containers. Node.js below 22.23.4, 24.22.1 or 26.12.1, any end-of-life line, or Bun below 1.4.4 is vulnerable. Check the base image tags in your Dockerfiles too. Images pinned by digest need an image scan, because the tag doesn’t show the version.
2. Check Python environments. Run pip show brotli brotlicffi. brotli below 1.2.1 or brotlicffi below 1.2.1.0 bundles the vulnerable decoder. Remember that requests, httpx and aiohttp use it whenever it’s installed.
3. Check .NET. A .NET 8, 9 or 10 runtime below 8.0.33, 9.0.22 or 10.0.14 is affected, but only applications that turn on Brotli decompression are exposed (see the settings in the update above).
4. Look for a path to the decoder. Express 5, body-parser 2.x, the Koa body parsers, @fastify/compress with request decompression, fetch() of user-supplied URLs or direct node:zlib Brotli calls. A service that has one of these and a vulnerable runtime goes to the top of the list.
5. Check proxies. Envoy and Istio are exposed only when the Brotli decompressor is turned on.

About PoCs and scanners. A public proof of concept exists, and code execution has been shown on the official Node.js 24.22.0 arm64 image, and CISA confirmed exploitation in the wild on October 27. Start with a version check rather than a network scan: exposure depends on whether a service decodes Brotli, which a scan from outside may not reach. Only test systems you own or are authorized to test.

Beyond Node.js

Some coverage calls this HTTP2Shell or Broccoli2Shell. It is the same CVE-2026-111497, not a new vulnerability: any software that decodes untrusted Brotli data with an unpatched copy of the library is exposed.

• Python clients. urllib3 (and so requests), httpx and aiohttp decode Brotli responses whenever brotli or brotlicffi is installed. Scrapy requires brotli, so every Scrapy install is exposed until brotli is upgraded. pip is not affected, because its bundled urllib3 has Brotli turned off. Code execution has not been shown for the Python packages.
• Python servers. The aiohttp server decompresses Brotli request bodies by default when brotli is installed.
• Other bindings. The Java library com.aayushatharva.brotli4j is fixed in 1.24.0 and the Ruby brotli gem in 0.9.1. curl_cffi bundles Brotli 1.2.0 and has no fixed release yet. Go’s cbrotli binding links the system library, so it needs a patched libbrotli.
• Proxies. Envoy and Istio are affected only when the Brotli decompressor is enabled. Envoy is fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, and Istio in 1.31.2, 1.30.6 and 1.29.9.
• System libraries. curl decodes Brotli only with –compressed, through the libbrotli it links. Debian and Red Hat have shipped fixed brotli packages.

How Cycode Helps

The Threat Intelligence dashboard has five items for CVE-2026-111497. Each shows how many assets in your organization match and opens the query behind it in the Context Intelligence Graph. Every result links the asset to its repository, so the team that owns the fix is clear.

Services that accept Brotli bodies. This query finds a Dockerfile on a vulnerable Node.js or Bun image and, in the same directory, a dependency that decompresses Brotli request bodies: Express 5, body-parser 2, the Koa body parsers or @fastify/compress. Express 5 and body-parser 2 are the request paths shown to reach code execution in public research, so services that match both conditions are the ones to patch first. A match does not prove the route is reachable from outside, and the query does not see fetch() of user-supplied URLs or direct node:zlib use, so the runtime queries below still matter.

Dockerfiles on vulnerable runtimes. This query finds Dockerfiles that build on Node.js below 22.23.4, 24.22.1 or 26.12.1, on an end-of-life Node.js line or on Bun below 1.4.4. It flags digest-pinned Node.js and Bun images for review, because their version cannot be read from the tag. It also catches nvm install and NodeSource setup lines that install a vulnerable version.

Container images. Two more items look inside built images. One finds images whose Node.js or Bun runtime is below the fixed version. The other finds images that ship the distribution Brotli library in the affected range, for review against your distribution’s advisory, since distributions may backport the fix.

Code dependencies. A fifth item finds projects that depend on a library bundling the vulnerable decoder: brotli, brotlicffi and curl_cffi in Python, com.aayushatharva.brotli4j in Java and the Ruby brotli gem. It includes indirect dependencies, since HTTP clients often pull these in through other packages.

We tested each query against repositories with known-vulnerable and known-fixed versions before release.

First 24 Hours

1. Find services that run Node.js below 22.23.4, 24.22.1 or 26.12.1, or Bun below 1.4.4, including base images and build hosts.
2. Start with services that decompress request bodies (Express 5, body-parser 2, Koa body parsers or @fastify/compress), fetch user-supplied URLs or pass untrusted data to the node:zlib Brotli functions.
3. Upgrade the runtime and rebuild the images, including standalone binaries built with bun build –compile. Replace end-of-life Node.js lines.
4. Until the rebuild ships, reject Content-Encoding: br at the proxy or load balancer, or turn off inflation in your body parsers. Match br case-insensitively, including inside lists such as gzip, br. Turning off inflation rejects every compressed body, gzip included. Neither covers Brotli responses read by fetch().
5. Check images for the distribution Brotli library and apply your distribution’s update.

Sources

• Node.js October 2026 security releases
• CVE-2026-111497 record
• google/brotli releases
• Bun v1.4.4 release notes and Bun issue #46352
• Express 5 migration guide: Brotli encoding support
• The Hacker News: code execution demonstrated
• GitHub advisory GHSA-9v8h-qqgm-4m35 (PyPI brotli and brotlicffi)
• OSV: CVE-2026-111497
• Envoy advisory GHSA-3wvj-j6qm-62mr
• Istio security bulletin ISTIO-SECURITY-2026-007
• Brotli4j advisory GHSA-x524-jrqf-vwq6
• Ruby brotli gem issue #64
• curl_cffi issue #895
• Debian security tracker: CVE-2026-111497
• Microsoft Security Response Center: CVE-2026-111497
• .NET October 2026 out-of-band security updates