> ## Content Index
> Fetch the complete content index at: https://engineerpal.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# HTTP2Shell Brotli bug reaches Node.js, Python clients, Bun and Envoy
- URL: https://engineerpal.com/http2shell-brotli-cve-2026-111497/
- Published: 2026-10-25T11:00:00.000Z
- Updated: 2026-10-26T01:46:50.000Z
- Description: Fixes for CVE-2026-111497 are out; code execution has been shown in a lab on one Node.js build, and no attacks in the wild have been reported.
- Author: Nina Park
- Tags: Security, Node.js, Python, Bun, Envoy

A memory-corruption bug in Google's Brotli decompression library, nicknamed HTTP2Shell and tracked as CVE-2026-111497, reaches well beyond Node.js into Python HTTP clients, Bun, Envoy and Istio, and patched versions are now out for each.

The flaw is an out-of-bounds write in Brotli's decoder, versions 1.0.3 through 1.2.0, according to the [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2026-111497?ref=engineerpal.com). Google fixed it in [Brotli 1.2.1](https://github.com/google/brotli/releases/tag/v1.2.1?ref=engineerpal.com), published at 3:27 p.m. ET Oct. 21, and in 1.1.1 and 1.0.10 for older lines.

"An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer," the Node.js project said in its [security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases?ref=engineerpal.com). Patched decoders now reject that input with a new format error.

Google, which assigned the CVE, rates it 9.2 (critical) on CVSS 4.0 in the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-111497&ref=engineerpal.com). Singapore's [Cyber Security Agency](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-154/?ref=engineerpal.com) cites 9.8 on the older CVSS 3.1 scale, while Node.js calls it high. NVD hasn't scored it yet.

Google's CVE description says the bug could let an attacker "potentially execute arbitrary code," but shown exploitation is narrow. Imperva ran code on the official Node.js 24.22.0 Linux arm64 image after several attempts, and hasn't released the exploit or tested other builds, [Tanium](https://www.tanium.com/blog/http2shell-find-and-fix-vulnerable-brotli-copies-with-tanium?ref=engineerpal.com) reported. Public proofs of concept mostly cause crashes, and no exploitation in the wild has been reported.

The CVE wasn't in CISA's [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=engineerpal.com) when EngineerPal checked at 5:10 a.m. ET Oct. 25\. One researcher argues the bug can only crash software, a single analysis that Node.js and Google don't share, according to Tanium. [Red Hat said](https://access.redhat.com/security/cve/cve-2026-111497?ref=engineerpal.com) there's no public, reliable proof of concept for remote code execution.

The name is unofficial. Imperva called it "Node2Shell" after Node.js disclosed the bug Oct. 21, and [Aikido](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497?ref=engineerpal.com) renamed it HTTP2Shell once Python exposure was clear. Node.js credits OpenAI Codex Security with the report.

HTTP2Shell is unrelated to [PHP2Shell](https://engineerpal.com/php2shell-php-rce-patch/), which we covered Oct. 23.

## How HTTP2Shell reaches servers and clients

The bug works in both directions. Inbound, an attacker sends a request body marked `Content-Encoding: br` to a server that decompresses it; Imperva's lab result went through Express 5 request parsing. Outbound, an app fetches from a server the attacker controls, and the Brotli response is decoded automatically.

That outbound path covers Node's `fetch()`, Bun's `fetch`, and Python's requests, urllib3, httpx and aiohttp when a Brotli package is installed, according to OSV. Those Python libraries aren't buggy themselves. Tanium says services that fetch user-supplied URLs, such as webhooks, link previews and scrapers, face higher risk.

Nobody has published code execution against Python or Bun, according to Tanium. Researchers confirmed memory corruption in the Python package with a memory-error detector but didn't attempt an exploit, Aikido reported.

Envoy and Istio are exposed only where a Brotli decompressor is configured, per the [Envoy advisory](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr?ref=engineerpal.com) and [Istio bulletin](https://istio.io/latest/news/security/istio-security-2026-007/?ref=engineerpal.com). Node's own advisory says end-of-life versions such as 20.x "are always affected" and get no fix.

## Am I affected? HTTP2Shell fixed versions and checks

These are the patched releases from each project's advisory. For Envoy, treat versions before the patched releases as affected.

| Product                    | Fixed in                                     |
| -------------------------- | -------------------------------------------- |
| Node.js 22.x / 24.x / 26.x | 22.23.4 / 24.22.1 / 26.12.1                  |
| Node.js 20.x and older     | No fix; move to a supported line             |
| PyPI brotli                | 1.2.1                                        |
| PyPI brotlicffi            | 1.2.1.0 (per Aikido)                         |
| Bun                        | 1.4.4                                        |
| Envoy                      | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12      |
| Istio                      | 1.31.2, 1.30.6, 1.29.9 (1.29 is end of life) |

Check what you run with these commands. For Node.js, go by the version number from `node -v`, since Node cherry-picked the fix rather than necessarily bumping its bundled Brotli version.

```bash
node -v
pip show brotli brotlicffi
bun --version
envoy --version
istioctl version

```

1. **Python:** run `pip show` in every virtual environment, container image and Lambda layer, then `pip install -U brotli brotlicffi` and rebuild images.
2. **Bun:** upgrade to 1.4.4 and rebuild any `bun build --compile` binaries. The [Bun advisory](https://github.com/oven-sh/bun/security/advisories/GHSA-663w-cv8g-jj2p?ref=engineerpal.com) offers `fetch(url, { decompress: false })` as a per-request workaround.
3. **Everything else:** install distro updates for system Brotli and curl as they ship (Tanium lists Ubuntu, RHEL and SUSE among those without a fix yet), then redeploy, restart and confirm running workloads use patched builds.
4. **Hunt and avoid:** look for processes that crashed during decompression and inbound `Content-Encoding: br` requests, and don't run unvetted HTTP2Shell scanners or proof-of-concept repos, which Tanium warns can carry malware.