Brotli flaw expands Node2Shell risk across HTTP applications

SecurityOnline[.]info reports that Aikido Security has expanded the Node2Shell vulnerability into what researchers are calling the HTTP2Shell flaw, tied to a Brotli decompression bug. The issue began with Node2Shell and CVE-2026-111497, but is now understood to affect numerous HTTP applications that rely on the Brotli decoder.

The core risk lies in the Brotli parsing logic: malformed compressed streams can trigger out-of-bounds memory writes during decoding, enabling process crashes, data leaks and arbitrary code execution. Exploitation requires a vulnerable Brotli decoder and untrusted input; servers do not automatically become vulnerable merely by running HTTP services, and patching depends on the specific runtime and library in use.

The piece itemises concrete updates across runtimes: Node.js has patched 22.x, 24.x and 26.x lines to 22.23.4, 24.22.1 and 26.12.1 respectively, while Bun fixed the parser in 1.4.4. Python users should upgrade the Brotli library to 1.2.1, or, for brotlicffi users, to 1.2.10; Google has upstream fixes across 1.0.10, 1.1.1 and 1.2.1.

The report emphasises that these libraries operate independently, so updating one runtime will not secure other components; administrators should audit containers, dependencies and system packages, and if patches remain unavailable, disable Brotli decompression temporarily.

Imperva independently verified the exploit in lab conditions, demonstrating arbitrary command execution on a Node.js 24.22.0 Linux ARM64 system with Brotli data, though reliability varied; patched Node.js 24.22.1 builds were shown to block the exploit. The article thus attributes findings and fixes to Aikido Security, Imperva and the respective runtime maintainers.