Node2Shell / HTTP2Shell (CVE-2026-111497): Identify & fix vulnerable assets

What is CVE-2026-111497 (Node2Shell / HTTP2Shell)?

CVE-2026-111497 is a memory-safety bug in the reference C implementation of Brotli, the compression format that Google developed and most of the web uses for HTTP content encoding (Content-Encoding: br).

The decoder function that handles "block switches" (points where a Brotli stream changes Huffman tables) returned a plain true/false value. A false return could mean either "the stream is malformed" or "I need more input", and callers could not tell the two apart. A crafted stream that forces an impossible block switch is treated as "needs more input", so the streaming decoder keeps appending attacker bytes into an eight-byte internal buffer and writes past its end. The CVE record pairs CWE-252 (unchecked return value) with CWE-787 (out-of-bounds write).

Node.js was the first to disclose and patch, which is why the flaw is widely called "Node2Shell". As Python, Bun, Envoy and others confirmed they were affected, "HTTP2Shell" (and "Broccoli2Shell") came into use for the wider issue. They are all the same CVE, and because Brotli is copied into each project that uses it, each one has to ship its own fix.
The upstream fix also sat unreleased for months, and once the issue was disclosed, vendor patches arrived on different days:

Why is CVE-2026-111497 critical?

• Critical severity, no authentication required: Google scored it CVSS 9.2. It can be triggered remotely with no privileges or user interaction, simply by getting a crafted Brotli stream decoded.

• Works in both directions: a malicious client can attack a server that decodes Brotli request bodies, and a malicious server can attack any client that fetches a Brotli response. Internal services that call external APIs are exposed too. Common routes into the decoder are Express 5 / body-parser 2 request parsers, Koa and Fastify body parsers, Node's built-in fetch(), and Python's requests, httpx and aiohttp clients.

• Wide and growing blast radius: Node.js 22/24/26, Bun, the Python Brotli and brotlicffi packages, Envoy, Istio, curl builds and OS packages all bundle the vulnerable decoder. Your code does not need to import Brotli to be affected.

• Proof of Concept (PoC) availability: Imperva reports achieving code execution in its lab on an unmodified Node.js 24.22.0 image (Linux arm64, several attempts needed); the exploit has not been released and no one else has reproduced it on a standard build. A separate public PoC produces a crash and a limited memory read on a standard build; it reached code execution only on a deliberately weakened build. No in-the-wild exploitation has been confirmed and the CVE is not in CISA KEV as of this writing.

• Scanner blind spots: advisory databases lagged in mapping the CVE to the Python packages, and runtimes bundled inside container images, Electron apps and CI runners are often missing from package inventories.

Which systems are affected / not affected by CVE-2026-111497?

Systems affected: any runtime, library or product that decodes Brotli with Google Brotli 1.0.3 through 1.2.0. Confirmed so far:

Also treat as affected: Electron desktop apps and CLI tools that ship their own Node binary, container images built before October 21 that include Node.js, Bun or the Python packages, and any API gateway, reverse proxy or HTTP client that bundles Brotli.
Systems not affected:

• Apache httpd with the standard mod_brotli (it compresses but does not decode), and Nginx in its default configuration.

• A bare Node.js HTTP server that does not decompress incoming request bodies and does not fetch external responses.

• Applications that never decode Brotli data from an untrusted source.

Note that updating npm packages does not fix this. The vulnerable code is in the Node.js runtime binary itself, and the unrelated npm package named "brotli" has nothing to do with it.

How to identify affected systems

Before you begin, run a global discovery to ensure you're working with the most current data from your environment.

1: Using the Axonius AI Companion

Use the AI Companion to identify assets running vulnerable Node.js, Bun, Python Brotli packages, Envoy or Istio, broken down by public internet exposure and by hosting plane (cloud, on-prem, workstations, and remote).

Scoping vulnerable assets and building a dashboard:

Mobilizing action:

2: Using the Axonius MCP

To identify vulnerable assets, use a similar prompt as the Axonius AI Companion. Replace building dashboards and mobilizing action with your harness systems of preference.

3: Using Axonius Queries

To identify instances of CVE-2026-111497 using Axonius Queries directly:

1. Already identified by your vulnerability scanners or CNAPP solutions: go to Assets > Exposures > Aggregated Security Findings and search for findings with the CVE: CVE-2026-111497. 

2. Not identified by your vuln scanners, but presence: Because vulnerability scanners might lag behind emergency disclosures or not be able to scan all assets and surfaces, proactively hunt for devices running the affected software. Go to Assets > Compute > Devices, and search for systems with installed software where Software Name contains node, nodejs, bun, brotli, brotlicffi, envoy or istio. Compare the reported versions against the fixed releases in the table above.

3. Publicly exposed to the internet: To identify publicly exposed servers running the affected software, expand the query from step 2 including the field Internet Exposure = Inbound Exposed or Inbound Partially Exposed.

4. End-of-life Node.js that will never be patched: From the query in step 2, filter Software Name contains node and Software Version is 21.x or older, 23.x or 25.x. These assets need a runtime migration, not a patch, and should be tracked separately.

How to remediate and mitigate CVE-2026-111497

1. Apply the vendor patch to the runtime or library, not the application package: Node.js 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, libbrotli 1.0.10 / 1.1.1 / 1.2.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0, Envoy and Istio per the table above, and your OS vendor's security update. Updating npm packages does not fix it. Patch first the services that decompress request bodies or fetch URLs they do not control.

2. Rebuild and redeploy anything that bundles a runtime: container images, serverless bundles, Electron apps and compiled CLIs stay vulnerable until they are rebuilt on a patched version. Move workloads on end-of-life Node.js (21.x and older, 23.x, 25.x) to 22.x or 24.x, since those lines will not get a fix.

3. Until you can patch, block Brotli at the edge: reject requests whose Content-Encoding includes br (match it case-insensitively, including in lists such as gzip, br) at the reverse proxy, load balancer or middleware, and remove br from Accept-Encoding on outbound clients. Vendor WAF rules (see below) cover inbound traffic only. None of this replaces the patch.

WAF and network detection coverage

Several edge providers have shipped rules for this CVE: 

• Cloudflare added two detections to its Managed Ruleset on October 25, one for requests that declare Brotli Content-Encoding and one for the Next.js image optimizer path; both default to Log so you can review matches before switching to Block. 

• Vercel enabled blocking rules for all projects on October 21.

• Microsoft published Azure WAF guidance on October 23: DRS 2.2 rule 920450 covers Application Gateway and Front Door Premium in Prevention mode, with a custom rule offered for Front Door Standard. 

• Imperva added dedicated WAF rules validated against its own exploit.
  All of these cover inbound requests only. 

None of them sees Brotli responses that your services fetch from other servers, and none replaces the patch.

Additional CVE-2026-111497 resources and advisories

Reviewed October 25, 2026. More vendor advisories are expected; re-check on publish.

Primary and upstream:

• CVE-2026-111497 record (Google, CNA)

• NVD entry for CVE-2026-111497

• Google Brotli 1.2.1 release

• GitHub Advisory GHSA-9v8h-qqgm-4m35

• OpenAI Codex Security advisory

Runtime and library vendors:

• Node.js: Wednesday, October 21, 2026 Security Releases

• Bun security advisories

• Envoy advisory GHSA-3wvj-j6qm-62mr

• Istio: ISTIO-SECURITY-2026-007

Platform and OS vendors:

• Vercel: Node.js security advisory, Brotli decoder RCE

• Amazon Linux Security Center: CVE-2026-111497

• Red Hat CVE-2026-111497

Government CERTs:

• CERT-FR: CERTFR-2026-AVI-1367

• GovCERT.HK: High Threat Security Alert A26-10-37

• CISA Known Exploited Vulnerabilities catalog (not listed as of October 25)

Research:

• Imperva: Node2Shell, from Brotli data to remote code execution

• Aikido: Node2Shell evolves to HTTP2Shell