HTTP2Shell Brotli bug reaches Python, Bun and Envoy

A memory bug in Google's Brotli decompressor now has a catchier name and a wider reach. First patched in Node.js on October 21, 2026 as "Node2Shell," CVE-2026-111497 has been called "HTTP2Shell" since late October 23 UTC. The new name reflects how far it spreads: Python HTTP libraries, the Bun runtime and the Envoy and Istio proxies all ship affected code.

Security firm Aikido scores it 9.2 out of 10 (critical) under CVSS v4.0, the standard severity scale. Brotli is a compression format that web servers and browsers use to shrink data. Any program that unpacks Brotli data from a stranger may be exposed.

One bug, two names

HTTP2Shell is not a second flaw. "It is one CVE, not a second flaw," Brandefense, a threat intelligence firm, writes in its tracker. It is the same Brotli decoder bug under a new label.

Tech AI Wire covered the first round of fixes in Node.js's October security release. What changed since is the list of affected projects.

How the bug works

The flaw sits in Brotli versions 1.0.3 through 1.2.0. The Node.js advisory explains it. An invalid "block switch" in a compressed stream was treated as a temporary need for more input, instead of a format error. The decoder then kept writing into an eight-byte internal buffer, past its end.

Writing past a buffer can crash a program, leak memory or, in the worst case, let an attacker run code. Brotli's own release notes say the "out-of-bounds write permits remote code execution."

The Node.js advisory credits OpenAI Codex Security, OpenAI's automated code-review tool, with the report. Aikido says OpenAI found it works in both directions. A malicious client can attack an unpatched server, and a malicious server can attack an unpatched client.

Aikido adds that the root cause was fixed in Brotli's source code in February. Nobody flagged it as a security fix, so no release carried it until October 21.

Why Python apps are exposed

Many Python apps use Brotli without ever importing it. Aikido says urllib3 and requests, httpx, aiohttp and Scrapy all use Brotli automatically when it is installed. Python's Brotli package is downloaded 82.8 million times a month.

There is a second catch. As of October 23, the CVE record, the OSV database and GitHub's advisory database did not link the CVE to either Python package, Aikido reports. So pip-audit, Dependabot and Safety would not flag a vulnerable version.

Fixed versions

Project	Fixed in
Google Brotli (C library)	1.0.10, 1.1.1, 1.2.1
Brotli on PyPI	1.2.1
brotlicffi on PyPI	1.2.1.0
Node.js	22.23.4, 24.22.1, 26.12.1
Bun	1.4.4
Envoy	1.40.0, 1.39.3, 1.38.6, 1.37.8
Istio	1.29.9, 1.30.6, 1.31.2

Some versions get no fix. Node.js 20.x, 25.x and 18.x are past end of life, and Brandefense quotes Vercel saying Node 20 "will not receive this fix." Brandefense also lists Debian's newer Brotli packages without a fixed version yet. Aikido says Apache's mod_brotli and Nginx do not decode Brotli by default.

Is it being exploited?

No attacks in the wild had been reported as of 22:00 UTC on October 23, Brandefense says. The flaw is not on CISA's list of known exploited bugs.

How bad it is in practice is still disputed. Researcher Ron Masas says his team reproduced remote code execution without a login. Brandefense notes that published proof-of-concept code mostly produces crashes, and one analysis argues only a denial of service is possible.

What this means for developers

Patch first, then check your lock files by hand. Because scanners may not flag the Python packages, search for Brotli and brotlicffi in your dependency lists and upgrade to 1.2.1 or 1.2.1.0.

Do not assume a server is the only target. If your code fetches data from outside servers with requests, httpx or aiohttp, a hostile server can send the bad stream. Aikido warns that "changing Accept-Encoding alone is insufficient," because that header only asks the server not to compress.

On Node.js, check what your framework decodes. By Brandefense's reading, Express 5 decodes Brotli request bodies by default and Express 4 does not. Masas put the risk plainly: "app.use(express.json()) is enough."

If you run Envoy or Istio as a service mesh, upgrade the proxies too. Anything that bundles its own copy of Brotli needs a rebuild, not just a system update. Where no patch exists yet, Aikido recommends turning off Brotli decoding.

A separate PHP flaw, PHP2Shell, drew attack attempts before its disclosure earlier this week. Treat this one with the same speed.