HTTP2Shell: the Brotli Bug Behind PHP2Shell's Naming Season Reaches Node and Python

The week’s vulnerability naming convention got its third entry. CVE-2026-111497 is a high-severity out-of-bounds write in the Brotli decoder bundled with Node.js, disclosed October 21 with fixed releases (22.23.4, 24.22.1, 26.12.1), and on October 23 Aikido reported the blast radius expanding beyond Node: Python HTTP stacks with the Brotli or brotlicffi packages installed are affected too, prompting the escalation from Node2Shell to HTTP2Shell. No in-the-wild exploitation has been reported as of October 22, but researchers demonstrated code execution against an unmodified Node 24.22.0 Linux arm64 image, unreliably, which in practice means “demonstrated.”

The chain: any path that decompresses attacker bytes

The bug is an out-of-bounds write in the Brotli decoder itself, so the attack surface is every code path that hands attacker-controlled compressed data to it. Aikido maps three: inbound requests, where Express 5 and body-parser 2.x decompress request bodies carrying Content-Encoding: br; outbound fetch(), where Node auto-decompresses Brotli responses, meaning a compromised webhook or any server a user-supplied URL points at can deliver the payload; and direct use of node:zlib Brotli functions on untrusted input. The fix has an interesting provenance: it landed in the Brotli project in February 2026 (commit 0ed4268a, shipped in Brotli 1.2.1, 1.1.1, and 1.0.10), and Node cherry-picked it eight months later, one of ten CVEs in the October security release. Bun 1.4.4+ is fixed; Node 20, 23, and 25 are end-of-life and will never be.

Why this family keeps repeating

The structural lesson is the one PHP2Shell already taught this month: the code that decodes the world’s bytes, written in memory-unsafe C and bundled invisibly into every runtime, is a shared attack surface that individual language communities patch on lagged schedules. Node bundles Brotli; Python web stacks pull it in as a package; PHP bundled its own decoder chain; and each ecosystem’s fix arrived on its own calendar for the same class of bug. The operational consequence is the part most teams get wrong: Aikido’s guidance stresses that pinned container tags like node:24.22.0 remain vulnerable until re-pinned and images rebuilt, distro-packaged Node may link the system Brotli instead (patch via the distro), and there is no official workaround because the outbound-fetch path cannot be disabled. Vercel added firewall rules blocking Content-Encoding: br on October 21, but that stopgap covers inbound requests only.

What to watch

Three things determine whether HTTP2Shell stays a lab event. First, exploitation: no in-the-wild cases are confirmed, and the public proof-of-concept from October 22 achieved execution only on a weakened test build, so the gap between demonstrated and weaponized is still open. Second, the Python scope: Aikido’s expansion post put HTTP libraries on notice, and the specific vulnerable versions and packages there deserve their own disclosure rather than a name change. Third, the meta-pattern: two memory-safety decoder bugs in two weeks, both with months-long windows between fix-upstream and fix-in-runtime, both affecting effectively every deployed service. The formal-verification results published Wednesday, machine-checked memory safety for 123 C libraries at the assembly level, stop sounding academic when the same decoder bug sits unpatched in eight months of Docker images. Run node --version everywhere, including containers; grep your code for createBrotliDecompress and your outbound fetches; and assume the next X2Shell name is already in someone’s tracker.