Brotli flaw CVE-2026-111497 hits HTTP libs beyond Node.js
Original: Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
Why This Matters
Brotli's ubiquity in HTTP stacks makes this a broad, fast-moving supply chain risk.
A Brotli decompression flaw (CVE-2026-111497) first disclosed in Node.js on Oct 21, 2026 now affects Python packages and other HTTP libraries, expanding its blast radius to a wide range of apps.
What started as a Node.js-specific issue has quickly grown into a multi-language crisis. On October 21, 2026, Node.js disclosed CVE-2026-111497 — dubbed 'Node2Shell' — revealing that a Node.js process decompressing attacker-controlled Brotli data could leak memory or execute arbitrary code. Within 24 hours, Python followed with its own disclosure confirming the same CVE applied to Python packages. By October 23rd, the scope had widened further: the flaw was confirmed to affect other major languages and service applications that use HTTP, earning an expanded nickname, 'HTTP2Shell.' Brotli, Google's widely deployed compression library, is used across a vast range of HTTP clients and servers for content encoding. Patches are not yet fully available across the affected ecosystem. Aikido Security recommends auditing dependencies for Brotli decoding, staying alert for imminent patches across affected libraries, and — where no fix exists — disabling Brotli decoding as a stopgap until updates ship.